This morning i found movies inside my server (debian VPS, apache,webmin/virtualmin), files are located in /var/log/roundcube/./ and the user/group is www-data  I looked in my log (apache,proftp,auth) and i didn t found weird lines. rkhunter found nothing bad.  how can i check the history of a file (in hidden folder) or the way that the user uploaded movies in this folder.  i guess it s a backdoor but when i scan my website i found nothing bad.  i think i ll cut my website for a while and see if there is new movies in folder, if yes it means that the user have ftp/ssh access or that the backdoor is not in my var/www/  Thanks by advance
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
Compute $\int \frac{\sin(x)}{\sin(x)+\cos(x)}\mathrm dx$ I'm having trouble computing the integral: $$\int \frac{\sin(x)}{\sin(x)+\cos(x)}\mathrm dx.$$ I hope that it can be expressed in terms of elementary functions. I've tried simple substitutions such as $u=\sin(x)$ and $u=\cos(x)$, but it was not very effective.  Any suggestions are welcome. Thanks. Is the following just a matter of showing the 3 properties that make up a metric??  Define d on $\Bbb R\times\Bbb R$ by $d(x,y)=\min \{1,|x-y|\}$. Show that $d$ is a metric on $\Bbb R$     $d(x,y)=0$ if $x=y$   $d(x,y)=d(y,x)$ for every $x,y \in X$   $d(x,y)\le d(x,z)+d(z,y)$ for every $x,y,z \in X$ Is there an exception to the prohibition against ending a sentence with “ ’s ” at work here? The ’s can be used as a contraction representing a weak, unstressed word that is not pronounced.  It allegedly cannot occur in sentence final position.        She is not ready, but he is.   She’s not ready, but he is.   She’s not ready, but *he’s.      The last one is not grammatical there.  Similarly, here the last one is not grammatical:        He has not started yet, but she has.   He’s not started yet, but she has.   He’s not started yet, but *she’s.       claims this is because you cannot end a sentence with a weak form.  It backs up its point with reasonably scholarly documentation.  However, this does not seem to be invariably true.        Shall we go to the movies?  Yes, let us go.   Shall we go to the movies?  Yes, let’s go.   Shall we go to the movies?  Yes, let’s.      Unlike the third example in the first two sets, here in this case the third example is indeed grammatical, despite ending with a weak form.  Is this an exception to the rule, or is there another rule at work here? If I inherit from a base class and want to pass something from the constructor of the inherited class to the constructor of the base class, how do I do that?  For example, if I inherit from the Exception class I want to do something like this:  class MyExceptionClass : Exception {      public MyExceptionClass(string message, string extraInfo)      {          //This is where it's all falling apart          base(message);      } }   Basically what I want is to be able to pass the string message to the base Exception class. I'm creating a function where I need to pass an object so that it can be modified by the function. What is the difference between:  public void myFunction(ref MyClass someClass)   and  public void myFunction(out MyClass someClass)   Which should I use and why? Plotting in the Complex Plane If I call a command using  in Ruby, how do I get its output?  system("ls") Let $f$ be a real-valued function continuous on $[a,b]$ and differentiable on $(a,b)$. Suppose that $\lim_{x\rightarrow a}f'(x)$ exists. Then, prove that $f$ is differentiable at $a$ and $f'(a)=\lim_{x\rightarrow a}f'(x)$.    It seems like an easy example, but a little bit tricky. I'm not sure which theorems should be used in here.    ==============================================================  Using @David Mitra's advice and @Pete L. Clark's notes I tried to solve this proof. I want to know my proof is correct or not.  By MVT, for $h&gt;0$ and $c_h \in (a,a+h)$ $$\frac{f(a+h)-f(a)}{h}=f'(c_h)$$ and $\lim_{h \rightarrow 0^+}c_h=a$.    Then $$\lim_{h \rightarrow 0^+}\frac{f(a+h)-f(a)}{h}=\lim_{h \rightarrow 0^+}f'(c_h)=\lim_{h \rightarrow 0^+}f'(a)$$   But that's enough? I think I should show something more, but don't know what it is. How to input a specific Pantone color number in Illustrator? Decreasing font size in verbatim How can I modify the following command to make it work?  \newcommand{\code}[1]{\begingroup \fontsize{10pt}{10pt}\selectfont \begin{verbatim} #1 \end{verbatim} \endgroup}   I currently get the following error on the close of the following verbatim block:  ! Undefined control sequence. &lt;argument&gt; ...endgroup ^^M^^M$\eta_{xi} = r_{xi} -                                                    q_i \cdot p_x$ \\^^M$q_i ... l.227     \end{verbatim} There was a great SF story I read some time ago (probably 25+ years ago) where there was a well known treasure trove, guarded by a killer robot that would ask all comers a series of difficult questions from all areas (math, physics, literature, history, etc.)  But everyone eventually failed and died... until the last person managed to make it past the robot:     By just answering gibberish to the robot.  Unfortunately, after collecting a ton of treasure, the robot casually asked him why he wanted it, he answered in a sensible way (something like "because it's valuable"), and the robot killed him, because he failed the final test.   Any ideas who wrote this?  What it was titled? I have created this with cycles:  But the edge between the glowing and non glowing materials is very sharp. The material was manually applied to faces in edit mode. Is there any way I can smooth the edge between them in cycles? How do I construct the $SU(2)$ representation of the Lorentz Group using $SU(2)\times SU(2)\sim SO(3,1)$ ? Skewness, kurtosis and how many standard deviations values are from the mean As is well known for the normal distribution, 68% of the probability mass is within one standard deviation of the mean, 95% within two standard deviations and 99.7% within 3 standard deviations.   However, I have some empirical distributions that are leptokurtic and negatively skewed. In such circumstances is there a formula based on their higher-order moments to calculate how much of the probability mass is within so many standard deviations of the mean?   I have a measurement and would like to give some sense of how far it is from the midpoint (mean or some other measure of central tendency).  Can this be done? Moving tfrom Shimano 9- to Shimano 10- speed I'm thinking of changing the 9-speed Tiagra rear mech on one of my (road) bikes to something, still Shimano, but 10-speed.  The obvious replacements I'll need are cassette, right-shifter and chain. But I reckon because of the narrower chain I'm also looking at a new chainset and rear derailleur. However I think the front derailleur and left-shifter should be safe (still keeping the front mech the same). Ditto the bb, regardless of whether I need a new chainset  Has anyone actually done this conversion and is able to confirm (or put me right)?  Thanks  Update  Decided in the end that going from 9- to 10- was too much to spend all in one go. But I used a service as an excuse to change the cassette (to a 9-speed ultegra) and the chain (dura ace) at quite minimal cost. Can upgrade other parts as and when, although I'm basically looking at Shim's 6500 range here so all quite dated now. Install Biber in MiKTeX on a 64-bit version of Windows Update: As of summer 2015 Biber is also included in the 64-bit repositories for MikTeX. There is no need to install Biber manually any more, it can simply be installed via the Package Manager just like other packages.   The question  describes how to use Biber with MiKTeX. But on the 64-bit version of MiKTeX Biber isn't installed.  How it is possible to install Biber on a 64-bit version of Windows?  Can I use this ? Which characters unlock each scene? Once a post has been edited, you can go into the revision list, and click "View Source".  If a post has not been edited (and I don't have the edit privilege) is there any way to see the raw Markdown?  The reason I ask I because of  - it's impossible to see the source markdown, and how it's different from the rendered Markdown.  Not exactly a huge issue, just curious! A ring without the Invariant Basis Number property I am on a MacBook Pro 13 running latest Sierra. I have an external Seagate solid state hard drive that was working and out of the blue stopped working. The only thing on it was my Adobe Lightroom images/videos. Not the LR DB files. I'm sure you have all heard this woe before, so I won't dwell on that. And yes, I back up to the cloud. AWS S3 specifically. Though I am traveling South East Asia for the last year, and staying in cheap hostels. So good internet is hard to come by sometimes. I can't back it up after every export. While most of it is backed up, there is some that is not.  Moving on. The symptoms seems to change every time I plug it in. The first sign was it ejected on it's own. I plugged it in again, and it wouldn't mount. Disk Utility recognized it, so did the command line diskutil list but it wouldn't mount. I rebooted and it worked for a second. Then I could only get to it from the command line. Then trying to frantically back up to my local what was not backed up to the cloud, it all failed. Basically just a cp -R [directory] [local-directory] command.  After some more frantic unplugging and re-plugging plus some command line manual mounts, I finally got it to where the Disk Utility would be able to run first aid on it. It failed. I don't recall the error. So I put it in a freezer. After a few hours I tried again. It is not any better. It still will not mount. Now Disk Utility sees it, but with no partition. I can't even give me information about how much space is used on it.  I have also tried it from a Windows machine. It did not mount. I have tried other cables. No success. As well as tried my other USB port. I also have another working external hard drive exactly like the one giving me issues. It works on all cables and USB ports.  I do have Docker running with a Ubuntu container, I'm trying to think of a way to see if I can try to get to the USB from there. I also have a USB that I have thought about running a live Ubuntu on there to see if I can mount and retrieve the data or fix the HDD that way. But if it will not mount, I doubt these will work.  Can anyone else think of any other tricks I can try myself to see if I can repair this or at least retrieve the data without paying for a service or software? If not, those suggestions are also welcome.  Update   I made the mistake in original post that it was a Solid State Drive. This is my mistake, it is actually a spinning disk hard drive. I bought them long ago and have been traveling with them for so long I just forgot. Question is updated to reflect this. Now diskutil list does not show it at all. The Disk Utility app also does not see it. Based on suggestion from @Allen I seeked out the USB to SATA cable. I did not quite find it, as my options are extremely limited where I am at. Though a local expat on a facebook group was able to help me with a empty 2.5 casing that I was able to extract the drive from original casing and put it in his blank case. It now mounts. Though it has the "click of death" sound to it. And data is not really reachable. While I can ls the directories and Adobe Lightroom does not have the exclamation mark when it can not reach the actual external files. Right clicking on the images and clicking on "Show in Finder" or any other variation of trying to get to the files through Finder or terminal, I have no success. It usually hangs and I get the spinning wheel. Since Adobe Lightroom imports these images into directories named by date, I am going to send the drive off to a data recovery service and ask to recover just unbacked up directories i.e. dates. Next time I will make harder efforts to backup and probably get an actual SSD.   I think this can be closed, due to my low reputation points I can not close this myself.