Re: barbut anyone?

> Hate to say it, but root ownership means server ownership in most
> cases. I'd be disinclined to trust any executables on that server now.
> Especially since you say that keeps returning.
Yip - you may already be in a bad way (thinking rootkits).
If your system is already compromised, you may need to boot up with some 
sort of live/recovery system & try your recovery from that.

Recover what data you can & start again from a sterile environment.

This may also mean that other hosts/nodes on your network could be 
compromised - nmap may help with analysing suspicious traffic.

Some interesting reading-material as mitigation for future reference:
* DSD Top 35 Mitigation Strategies 
(http://www.dsd.gov.au/infosec/top35mitigationstrategies.htm)
(still struggling to get my head around AppArmor/SELinux - it's a beast!)

Would be curious to know what AV's & other security 
suites/products/solutions other folks are using (Clam just doesn't cut it)

- J

_______________________________________________
NZLUG mailing list [email protected]
http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug