User attacking sites outbound

Sometimes user accounts get compromised and start attacking other, external sites. We don't really want to implement a firewall rule to block all outbound traffic on, say, port 80, so these attacks get through.

It is hard to determine what user process is doing the attacking and very hard indeed to figure out retrospectively.

Some tools to help are:

• lsof -i :80 | grep -v LISTEN - Show all connections on port 80. Ensure you're looking at outbound connections to port 80 and pay attention to the USER column.

• tcpdump -s 0 -a net 1.2.3.4/24 - Standard dump of all output going to a certain subnet. Useful if we know the subnet.

• lsof -p <PID> - Get a list of open files for this PID. Useful in combination with the first lsof, when we know the PID. Look for the earlier entries which are usually in /home and might point to the script location.