Re: Advice Needed On Recent Rootings
Hi Jason, hi all
> Server machines, no real desktop users. One of these was a firewall
> that pretty much only had SSH listening. *IF* it was hacked directly
> (rather than being compromised with a sniff'd password), then we've got
> something to target. The timestamps don't support much of anything,
> since we don't really have many logs left (he's stupid, but not
> st00p1d). Our logging infrastructure is . . . improving. Also, we're
> implementing grsecurity. I've been very impressed so far (and suspect
> 2.0 will be even better when it's stable).
How about an iptables skript that writes its logs to another machine?
And at the same time the skript should filter traffic from one server to
another...
Another point I would check is if all your _desktop_ computers are
yours. He might have hacked one just to get better access to your server
machines.
Just my 2€
Marc
Reply to: