[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: SSH attack



On Sun, Oct 02, 2005 at 10:57:25PM -0700, Jared Hall wrote:
> It looks like I am being rooted right now.  How do I toss this guy off
> of my system.  he has an IP address of 210.95.212.131
> 
> Please get back to me fast.  I took the compilers off of the system,
> and it's only running dns... so there's no firewall or anything.  I
> can't shut down ssh because that's my only connection to the system.

What makes you think you're being rooted?  (Terminology note: rooted
means that the user has obtained root access to your machine.  If you've
been rooted, you should do what you can to find the entry vector, and
then reinstall your machine from trusted media, taking care to insure
that the entry vector is now closed.)

noah

Attachment: signature.asc
Description: Digital signature


Reply to: