Re: LittleJohn Systems Site Hacked

[Warren Ernst <wernst@gmail.com>]

On Apr 20, 9:04 pm, sc...@alfter.DIESPAMMERSDIE.us (Scott Alfter)
wrote:
> In article <MOWdnZihDsqe3JfVnZ2dnUVZ_h-vn...@comcast.com>,
> Michael J. Mahon <mjma...@aol.com> wrote:
>
> >callapple.magaz...@gmail.com wrote:
> >> It appears that the Little John Systems site has been hacked.  If
> >> someone is in contact with James, let him know so that he can get it
> >> back up.
>
> >A friend of mine used to keep a small website up on a Linux machine
> >in his network's "DMZ".
>
> >He had a chron script that ran every night to copy the website backup
> >to the website files, just to cope with this problem.  He said that
> >he was logging dozens of probes per day.
>
> I suppose that'd work, but the better approach would be to keep your
> system updated.  I have a script that runs weekly to check my installed
> apps against what Gentoo says has vulnerabilities; if any are found, it
> fires off some email to me listing what needs to be upgraded.
>
> I think I've only had my server rootkitted once, and that was when I was a
> bit more lax about keeping up with updates.  I also used to have OpenSSH set
> to allow passworded logins and to allow logging in as root; both of those
> are now disabled, as I think that (combined with a vulnerable version of
> OpenSSH) was how the rootkit got in.
>
>   _/_
>  / v \ Scott Alfter (remove the obvious to send mail)
> (IIGS(http://alfter.us/           Top-posting!
>  \_^_/ rm -rf /bin/laden            >What's the most annoying thing on Usenet?

Of course, the *best* approach is to do both. That's what I do. ;-)

-Warr