3 ms·

I think monitoring your outgoing traffic would give you a clue. Also if what I read on Ars is correct, this botnet preys on weak root passwords, so disabling re

I think monitoring your outgoing traffic would give you a clue. Also if what I read on Ars is correct, this botnet preys on weak root passwords, so disabling remote root or using keys would be great ways to protect yourself against this botnet.

mirimir 11y ago
This! And also, in sshd_config, disable password-based authentication. But first, make sure that key-based authentication works ;)