Re: Help needed - server hacked twice in three days (and I don't think I'm a newbie)

[Moritz Muehlenhoff <jmm@inutil.org>]

In gmane.linux.debian.devel.security, you wrote:
> Now, I find it unlikely to see the same local root exploit in 2.4.18 and 
> 2.6.7. How did he gain root access?

Are you sure it's 2.6.7 and not 2.6.8, the Sarge kernel?
Anyway, there are several unfixed local privilege escalation security
issues in both 2.6.8 and 2.4.18 that are currently unfixed, several
of which have publicly available exploit code.

The interesting question about your system is what you are running on
top of your LAMP system. Did you install any web apps along side the
distribution?

Cheers,
        Moritz