Re: Hacked stable system?

[Gleb Arshinov <gleb@barsook.com>]

>>>>> "Justin" == Justin R Miller <incanus@codesorcery.net> writes:

    >> So, what could have caused ssh/telnet to hang like this while
    >> ftp worked fine?

    Justin> Check your local messages log and the remote one using the
    Justin> shell that you already have while you attempt a login.

The message logs are emptied on the affected machine.  I am not sure
what you mean by "shell that you already have while ..."

    >> What else should I check for break-in signs?

    Justin> Do you have debsums?  I believe this will check the MD5
    Justin> sums of your packages.  I've only played around with it,
    Justin> so I'm not positive.

Good suggestion.  I am running it right now.

    >> PS I'll include current ps aux:

    Justin> As a rule, especially on a colo box that's gonna sit by
    Justin> itself from time to time without you on it, you should
    Justin> take away all services and add what you need.  A firewall
    Justin> would be good too.

You are right.  I don't need most of these daemons.  I'll disable
them.

Thanks, these are all good points.

Gleb