I manage a private GNU/Linux server, that only I (should) have access. Over the last few months, it got invaded a few times, always by the same person (he/she runs the same application every time). This person manages to create a root account. I've changed passwords to very strong ones and deleted the created accounts, but they keep getting back in. The problem is I don't know where from.
My question is: what are the first steps that I should do to find where my vulnerability is?
Some general comments about my setup:
Debian 8.6
Main applications running in the server: apache, dovecot, exim, mysql and owncloud.
I have fail2ban running.
I have a script in my
.bashrc
(for my user and for root account) that warns me by email when someones opens a terminal with these accounts. It never gets triggered by the invader.The output of the
last
command shows they were using atty1
session (whereas when I'm logged it showspts/0
). Also in thelast
command, in the column that should say where the access is coming from, their entry is empty.