Re: Help. My system cracked and used to spam

["Paul Smith" <pausmith@nortelnetworks.com>]

%% "David Teague" <teague@jackson.main.nc.us> writes:

  dt> It is a stock 2.0 install from CDs with Exim installed and setup
  dt> by the scripts. Nothing particular was done to prevent entry.
  dt> What does "Properly locked down" mean?

Ouch.  First and foremost, it means that you've applied all security
updates.  I'm sure there are a number of security holes, some maybe
well-known, in a system that old with no security updates installed.
Go to http://debian.org and take a look at the number of security holes
plugged in just the last month... and 2.0 is years old.

It doesn't have to be an error in your configuration; there are bugs in
the software that can let crackers through even if your configuration is
correct.

Note that Debian 2.0 old enough that no more security updates are being
generated for it, so you want to install a newer version of Debian which
is still supported.  At this point you probably want Woody (since we
don't know exactly how much longer Potato will be supported).

Then, you should add the security updates site to your .deb sources (the
Woody install asks if you want to do this--say yes!)  Optionally you can
install software that will automatically download security updates and
notify you about them.

Also, you should subscribe to the debian-security mailing list so you
get notified when security holes are fixed.

And finally, you should install the security updates as soon as possible
after they're released.


That's just to protect yourself from bugs in software.  It doesn't
discuss what "bugs" you may have in your configuration of the software
that could let crackers in.  In general the rule is (a) don't install or
enable any software, especially network software, on your system you
don't need, and (b) use a firewall of some kind to restrict access to
your network or system except on the specific ports which require it.
We can't know what those are unless we know what services you need to
provide from the server.

-- 
-------------------------------------------------------------------------------
 Paul D. Smith <pausmith@nortelnetworks.com> HASMAT--HA Software Mthds & Tools
 "Please remain calm...I may be mad, but I am a professional." --Mad Scientist
-------------------------------------------------------------------------------
   These are my opinions---Nortel Networks takes no responsibility for them.