Let me just clarify one thing - my subject line was badly chosen. I
was and am painfully aware that I was hacked. What I really wanted
was to know if anyone know of such a hack and/or had experienced it
before.
> Hope you figure out how he got in. Has there been any other damage
> made to the system, other than some deleted log entries/added
> binaries?
The main thing that I've found so far (and I havn't done much digging
as I'm up the walls) is that he was grabbing user names and
passwords.
I'll look around some more but won't waste too much time on it. I'm
going to do a complete reinstall and upgrade to RH7.3. As has been
suggested I'll limit the number of hosts that can ssh in and lock
down everything else that I can.
Thanks for all your help guys.
Barry
--
Regards,
Barry O'Donovan barry.odonovan at ucd.ie
Mobile: +353 (0)86 2891589, Office: +353 (0)1 716 2454
Roinn na Riomheolaiochta, An Colaiste Ollscoile, Baile Atha Cliath.
Department of Computer Science, University College Dublin.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
