10.4 web server was hacked - how do I find out how this happened?

Question

I am running the most updated 10.4 OSX Server software on a computer (an iMac 800 which doesn't permit 10.5 Server to install!), and two days ago I noticed that all of my web pages for only one of the sites served by this computer had been rewritten to display all kinds of vulgar garbage after a nicely written banner that said "you've been hacked". In general, my network has DSL for internet with a static IP, and the router then forwards various ports to this computer for the three services that the computer provides: Web, AFP, Mail. Ports are open in the router to permit FTP, Server Admin and Workgroup server login as well, and there is only one admin account on this computer among the other 9 basic user accounts.
The Web server supports multiple virtual domains for this single IP address, each of which has a separate web documents folder. Only the main site was hacked - other folders were not touched.
I have replaced all of the files so my web site now displays the proper information, but I am interested in discovering how this occurred. I have no guest "write" access to the folders on this system that I know about.
What can I look for to determine how this occurred, and hopefully prevent its recurrence? Thank you for any advice!

Answer 1

Might want to increase your degree of paranoia by an order of magnitude or three here. With ftp and with the other stated ports open to the 'net, it's more of a wonder that the server didn't get hacked sooner. It's not really paranoia if the folks really are out to get you, and -- based on my server logs -- they are.
A user with an unauthorized account on your box means your security has been completely breached; that your server has been rooted, in the vernacular.
Getting rooted means you'll probably want to reinstall everything other than your application data from distro, from bare iron and Mac OS X Server on up. You'll want to pull what you can of that from your pre-breach backups and data archives. If you don't reinstall from known-good distros, who knows what else has been left around as a surprise or as a backdoor.
With a rooted server, that could be anywhere. Worse, that rooted server can be used as a foothold to gain further access, such as via no-password ssh or telnet or simply sniffing local telnet traffic.
I'd also look to upgrade the versions of php and any web-facing applications to the most current available versions, as attacks against many of those web-facing packages are active and underway.
And I'd change passwords on all the other servers and devices on the LAN.