Author here.
It was a brute force attack on my root. I added an edit for clarification on the article. Basically I use another user for deployments and server work that has a pub key and didn't remove root login permissions.
23 karma · joined September 10, 2014
It was a brute force attack on my root. I added an edit for clarification on the article. Basically I use another user for deployments and server work that has a pub key and didn't remove root login permissions.
The purpose of going through and removing the malicious scripts was to learn more about server security. I figured if I had been compromised I might as well learn what was causing it and how to fix it.
I have since toasted the server and set it back up with all of the things I mention in the article. I wrote the piece because I felt that there might be others out there who can learn from my mistakes and to also have a record for myself.
We are always learning and sometimes we need to learn the hard way, I got lucky in that this was on a side project and not any real client work.