RE: fileutils Question (Last)

You may try to remove and reinstall the fileutils but the version that you
install has to be the one that you actually use now.  Do not use the version
from the installation CD because it is incompatible with the updated kernel.

If it fails to install reinstallation is the only way to get the machine
back to life.
I have a suggestion that you install a new kernel that you do not actually
have say not the smp or bigmem kernel. Reboot with the new kernel and than
reinstall the currect version of the rpms. You must try the --force option.
Than reinstall the kernel you are actually using. Finally reboot with the
newly reinstalled kernel.
This is a kind of manual upgrade.

ALWAYS HAVE A BACKUP READY.

Another option is to use a new Hard Disk. Install on it a cloned secure
version of the OS containing the bin, sbin, and kernel. Copy the
configuration files (plain text files) to the clone. Finally mount the hard
disk to the compromissed system and boot from it. This way you have a clean
system to work on the infected one and the content of the web sites for
service. 
Try to find out how did you get infected. That is the thing that you must
fix prior to rebuilding or healing the system.
Good Luck

Sincerely
Mr. Olsi Lulani


-----Original Message-----
From: System [mailto:[email protected]] 
Sent: Friday, February 28, 2003 3:56 PM
To: [email protected]
Subject: fileutils Question (Last)

Hello All ,

Yeah! I have decided to move all the data to my new server. and then i'll
clean the old infected server.
But now i want to ask a last question??

If i remove fileutils-4.1-10.1 which has dependencies with other packages
( fileutils   is needed by kernel-smp-2.4.18-10
 fileutils is needed by MySQL-3.23.54a-1
 fileutils is needed by xinetd-2.3.7-4.7x
 fileutils   is needed by kernel-bigmem-2.4.18-3
fileutils   is needed by kernel-2.4.18-3
etc etc....
)
It'll Break those dependencies.
What will be the Consequences???
and if i Re-install it again will it work without affecting the
dependencies?
Or If it fails after re-installing , how do i bring it up??
What precautions should i take before doing this???

Sorry for so many questionss? I'll asure u if i got the answer this will be
my last question for TODAY ATLEAST!!! :)

Rgds,
Tina.


----- Original Message -----
From: "LULANI Olsi" <[email protected]>
To: <[email protected]>
Sent: Friday, February 28, 2003 7:47 PM
Subject: RE: LKM Trojan


> It is clear that it is inevitable that you are going to format the server
> sooner or later. My suggestion is that you move the web contect in another
> machine, Just the web content. Export the data via NFS and mount them
> read-only in the web server. The idea is to isolate web engine and the web
> content. It is easier to replace an empty web server than a loaded web
> server. Move the content to such a machine carefully checking it, and when
> the migration is over reinstall the web server.
>
> Sincerely
> Mr. Olsi Lulani
>
>
> -----Original Message-----
> From: Eric Koldeweij [mailto:[email protected]]
> Sent: Friday, February 28, 2003 2:30 PM
> To: [email protected]
> Subject: Re: LKM Trojan
>
> Well for one thing, your system is definitely not running perfectly.
> Right now it's probably sending all kinds of private data out on the net
> as well as allowing illegitimate entry to just about anyone. It's a
> matter of time before some vandal gets in and starts destroying stuff.
>
> I know it's very difficult for you to get the system offline but
> downtime is inevitable. I still strongly advise to reformat/reinstall
> and use a second server to minimize downtime. In any case there's going
> to be a lot of work and time involved. You can try to reinstall ALL rpms
> and find and eliminate the malicious kernel module(s) but you won't ever
> be sure the trojan's really gone and you can never trust the system
> again. This is (in my eyes) unacceptable for a webhosting server.
>
> I can offer advise on lots of things to improve security and minimize
> downtime. Upgrading/reinstalling MIGHT work but don't rely on it. You
> will need to locate the malicious kernel module and destroy it. Again, I
> strongly advise on taking the safe route, set up a new server from
> scratch, apply all security patches/firewalls, chuck everything you
> don't need, copy the client's data files to the new server and have it
> act as the webserver. When it's up and running, reformat/reinstall the
> infected server.
>
> If there was an easier way I (or anyone else on here) would certainly
> have suggested it.
>
> Eric.
>
> System wrote:
>
> >Thanks Eric, I appreciate ur help on this..
> >Actually its a LKM Trojan... which affected my fileutils and net-tools
> >checksum. and the surprise is the server is runnning perfectly, except
the
> >single ls command which says "segmentation fault" when executed. Else
> >everything is working fine.
> >
> >Will the upgrade of OS help???
> >
> >when i chkrootkit it says
> >Checking `rpcinfo'... INFECTED
> >Warning: Possible LKM Trojan installed
> >
> >Any clues for removing this.. all i got from the list is that I have to
> >re-install, but to be very frank at this moment i cannot format the
> >server!!!.
> >
> >Regards,
> >Tina.
> >
> >
> >
>
>
>
>
> _______________________________________________
> enigma-list mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/enigma-list
>
>
>
> _______________________________________________
> enigma-list mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/enigma-list
>
>
>




_______________________________________________
enigma-list mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/enigma-list