I feel as if my server (ubuntu 10.4) has been attacked. I'm a bit of a linux noob.
I run a website and a few rows of mysql data have been deleted. This has happened three times now.
- The auth log is empty prior to 2:00pm ET today. All that shows prior to my logins were a few cronjobs running. The data disappeared between 7pm and 10pm ET.
- I've never scheduled any cronjobs. There must be automated ones?
- The mysql error log is wiped clean.
- I use a password to log in- an obvious mistake I suppose.
Any recommendations? I clean user submitted data for sql injections already. MySQL is not available remotely. I suppose it's time to switch to a key for ssh access.