Re: LittleJohn Systems Site Hacked

[scott@alfter.DIESPAMMERSDIE.us (Scott Alfter)]

In article <MOWdnZihDsqe3JfVnZ2dnUVZ_h-vnZ2d@comcast.com>,
Michael J. Mahon <mjmahon@aol.com> wrote:
>callapple.magazine@gmail.com wrote:
>> It appears that the Little John Systems site has been hacked.  If
>> someone is in contact with James, let him know so that he can get it
>> back up.
>
>A friend of mine used to keep a small website up on a Linux machine
>in his network's "DMZ".
>
>He had a chron script that ran every night to copy the website backup
>to the website files, just to cope with this problem.  He said that
>he was logging dozens of probes per day.

I suppose that'd work, but the better approach would be to keep your
system updated.  I have a script that runs weekly to check my installed
apps against what Gentoo says has vulnerabilities; if any are found, it
fires off some email to me listing what needs to be upgraded.

I think I've only had my server rootkitted once, and that was when I was a
bit more lax about keeping up with updates.  I also used to have OpenSSH set
to allow passworded logins and to allow logging in as root; both of those
are now disabled, as I think that (combined with a vulnerable version of
OpenSSH) was how the rootkit got in.

  _/_
 / v \ Scott Alfter (remove the obvious to send mail)
(IIGS( http://alfter.us/            Top-posting!
 \_^_/ rm -rf /bin/laden            >What's the most annoying thing on Usenet?