Re: SSH attack

To: debian-user@lists.debian.org
Subject: Re: SSH attack
From: Andreas Janssen <andreas.janssen@bigfoot.com>
Date: Mon, 03 Oct 2005 08:55:03 +0200
Message-id: <[🔎] dhqkjj$2op$1@sea.gmane.org>
References: <[🔎] 547e6a320510022257h16636051l1c2ce306d0cb0963@mail.gmail.com>

Hello

Jared Hall (<jrhall@gmail.com>) wrote:

> It looks like I am being rooted right now.  How do I toss this guy off
> of my system.  he has an IP address of 210.95.212.131
> 
> Please get back to me fast.  I took the compilers off of the system,
> and it's only running dns... so there's no firewall or anything.  I
> can't shut down ssh because that's my only connection to the system.

Make an image of the hard disk if you can to find out how that guy came
in, and reinstall. You don't know what he changes on your system, so
there is hardly a way to safely revert everything he did.

best regards
        Andreas Janssen

-- 
Andreas Janssen <andreas.janssen@bigfoot.com>
PGP-Key-ID: 0xDC801674 ICQ #17079270
Registered Linux User #267976
http://www.andreas-janssen.de/debian-tipps-sarge.html

Reply to:

Follow-Ups:
- Re: SSH attack
  - From: Jon Dowland <lists@alcopop.org>

References:
- SSH attack
  - From: Jared Hall <jrhall@gmail.com>

Prev by Date: savagefb and acpi standby
Next by Date: Re: GNOME "other" menu
Previous by thread: SSH attack
Next by thread: Re: SSH attack
Index(es):
- Date
- Thread