[Résolu] [piratage] on vien de pirater mon serveur par alpha_one_x86 - page 1

Bonjour voila j'ai un serveur linux, avec ssh apache, et autre li s'est deja fait pirater, et la on viens de me l'eteindre, donc je vais booter sur un live cd pour avoir les log, mais je sais pas qui et ou on m'a pirater. Le seul truc que je sais, c'est qui s'est jamais etien tout suel et qu'on vien de me l'éteindre.

EDIT: voici une parti des log, et pour l'acces a ssh c'été pas moi.

Jan 17 18:02:34 toc sshd[5276]: Accepted keyboard-interactive/pam for root from 195.6.100.249 port 54079 ssh2
Jan 17 18:02:34 toc sshd(pam_unix)[5290]: session opened for user root by root(uid=0)
Jan 17 18:15:32 toc useradd[5458]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:16:48 toc useradd[5475]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:20:56 toc useradd[5526]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:21:35 toc useradd[5535]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:21:53 toc useradd[5539]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:22:27 toc useradd[5547]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:22:51 toc useradd[5553]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:23:12 toc useradd[5558]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:23:36 toc useradd[5564]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:23:36 toc useradd[5564]: new group: name=kconfig, GID=1007
Jan 17 18:23:36 toc useradd[5564]: new user: name=kconfig, UID=1006, GID=1007, home=/home/user/.kconfig, shell=/bin/bash
Jan 17 18:23:36 toc useradd[5564]: add `kconfig' to group `wheel'
Jan 17 18:23:36 toc useradd[5564]: add `kconfig' to shadow group `wheel'
Jan 17 18:24:07 toc useradd[5571]: unknown configuration item `GETPASS_ASTERISKS'
Jan 17 18:24:44 toc passwd(pam_unix)[5577]: password changed for kconfig
Jan 17 18:24:56 toc passwd(pam_unix)[5581]: password changed for kconfig
Jan 17 18:25:57 toc sshd[5598]: User kconfig from gw-arbois.henri-maire.fr not allowed because not listed in AllowUsers
Jan 17 18:26:01 toc sshd(pam_unix)[5603]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=gw-arbois.henri-maire.fr  user=kconfig
Jan 17 18:26:03 toc sshd[5598]: error: PAM: Authentication failure for illegal user kconfig from gw-arbois.henri-maire.fr
Jan 17 18:26:03 toc sshd[5598]: Failed keyboard-interactive/pam for invalid user kconfig from 195.6.100.249 port 54955 ssh2
Jan 17 18:26:06 toc sshd(pam_unix)[5605]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=gw-arbois.henri-maire.fr  user=kconfig
Jan 17 18:26:07 toc sshd[5598]: error: PAM: Authentication failure for illegal user kconfig from gw-arbois.henri-maire.fr
Jan 17 18:26:07 toc sshd[5598]: Failed keyboard-interactive/pam for invalid user kconfig from 195.6.100.249 port 54955 ssh2
Jan 17 18:26:29 toc passwd(pam_unix)[5610]: password changed for kconfig
Jan 17 18:26:33 toc sshd(pam_unix)[5607]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=gw-arbois.henri-maire.fr  user=kconfig
Jan 17 18:26:35 toc sshd[5598]: error: PAM: Authentication failure for illegal user kconfig from gw-arbois.henri-maire.fr
Jan 17 18:26:35 toc sshd[5598]: Failed keyboard-interactive/pam for invalid user kconfig from 195.6.100.249 port 54955 ssh2
Jan 17 18:43:50 toc sshd[5886]: Accepted keyboard-interactive/pam for root from 87.67.134.239 port 41752 ssh2
Jan 17 18:43:50 toc sshd(pam_unix)[5896]: session opened for user root by root(uid=0)
Jan 17 18:55:47 toc sshd[2537]: Received signal 15; terminating.

alpha_one_x86