Re: Advice needed, trying to find the vulnerable code on Debian webserver.
On Tue, 15 Jun 2004, Ross Tsolakidis wrote:
> I'd appreciate some help on how to stop this from happening.
Run something like aide so you can detect when it goes wrong (though there
are some caveats it does not sound like they will hit you) and run a
netflow-collector next to it, if you can. That way you can easily
discover where it is coming from and why.
Doesn't the logging on your loghost show anything?
Jan
--
/~\ The ASCII / Jan Meijer
\ / Ribbon Campaign -- -- SURFnet bv
X Against HTML / http://www.surfnet.nl/organisatie/jm/
/ \ Email http://cert-nl.surfnet.nl/
Reply to: