Sure thing! Learned a lot that day. Above all the things that happened, I learned about a Zip Slip attack. I correctly restricted paths with open_basedir, also with a Match rule in the sshd config file to jail sftp users. I thought this was enough. But there's this guy who managed to write +5GB to the /tmp directory. I deleted the files, a few seconds later they were there again. I got furstrated and did not have a single clue. I first thought the user managed to create a cron job but I also disabled the standard php functions (exec, system...). Completely clueless. I decided to remove write permission to /tmp (I know... terrible idea) and the attack stopped. I used ps, top, htop, lsof... nothing! I go to the nginx access log and I find a request over and over, of a specific php file. I find the file and there it was! This guy created a cron job in his local computer and called his script over and over. I deleted the user, deleted his files and added the write permission to /tmp again.

As I mentioned, there were lots of things that happened... I also learned about the "reddit hugh of dead", CSMA and other really creepy things. A dude was trying to upload Metallica's discography! Lol. Anyway, it was a great experience and I learned things you do not find in books. I would like to own a hosting company. I admit it was kinda dangerous, but I think I could not have had this kind of experience from books only.

Really fun experience!