Re: LKM Trojan

> The NFS connection is not in an insecured network. There should be a
> separate NIC that will connect the web content machine.
> The topology will be something like this:
>
> <web Content-NFS server>------Back LAN------<Web server>-------World LAN.
>
> Exporting read-only the content via NFS in such a way is no security
threat.

But having NFS access to other machines from a compromised system does. The
fact that
no user info gets passed is moot.

Remember that the perp got in somehow. I've seen this before on a BSD
machine where
the entry point was a poorl;y written and wrongly placed CGI script, built
by one of those
"impress your friends with this" CGI script tools found on the web. NFS
creates another
entry point to another machine.

> There is not username/password check as the content is public via
Internet.
> Databases must hold the confidential data, and must provide the access
> control to the content.

She's probably not running NFS. My guess what she has to work with is a
standalone
machine that she does incremental backups with either over the net or onto
tapes.