If you can log in via ssh (eg brute force) you normally get an unconfined login in normal selinux setups. But 20,000 hosts is not an ssh exploit, that would get

If you can log in via ssh (eg brute force) you normally get an unconfined login in normal selinux setups. But 20,000 hosts is not an ssh exploit, that would get more. Ah I see here http://malwaremustdie.blogspot.co.uk/2013/03/the-evil-came-back-darkleechs-apache.html http://malwaremustdie.blogspot.co.uk/2013/03/the-evil-came-b... that it only works in non selinux systems...