Re: Re: Is my system compromised
On Sat, Feb 04, 2006 at 09:47:38PM -0500, Carl Fink wrote:
> Remove the hard drive(s). Mount on another system and recover data BUT NOT
> PROGRAMS.
>
> Put the drives back in and boot from a known clean Debian CD. Reinstall
> Debian and your programs. Lock everything down using the Debian security
> tips at <http://www.debian.org/security/>.
>
> Once you're rooted, this is way easier and more effective than trying to fix
> things.
Agreed;
However, finding the reason why, and how, would save us all from
similar fate, at least it would spread the knowledge.
After you've determined you've been compromised, or feel like you
might have been but cannot determine why/how, the only way to
guarantee a pristine system, is to do a fresh install.
Then secure your box (per the link above).
Todd.
Reply to: