<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.12.0">
</HEAD>
<BODY>
<BR>
<BR>
On Fri, 2007-11-30 at 12:26 +1100, Amos Shapira wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
<FONT COLOR="#000000">On 30/11/2007, </FONT><FONT COLOR="#000000"><B>Ross S. W. Walker</B></FONT><FONT COLOR="#000000"> <<A HREF="mailto:rwalker@medallion.com">rwalker@medallion.com</A>> wrote:</FONT>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<FONT SIZE="2"><FONT COLOR="#000000">Find out how they got in and make sure that hole is fixed.</FONT></FONT><BR>
<BR>
<FONT SIZE="2"><FONT COLOR="#000000">Do an rpm verify on all installed packages (excluding configs), reinstall the rpms that fail the verify.</FONT></FONT><BR>
<BR>
<FONT SIZE="2"><FONT COLOR="#000000">Find all binaries that are not accountable in rpm and nuke them.</FONT></FONT><BR>
<BR>
<FONT SIZE="2"><FONT COLOR="#000000">Harden your host with selinux and audit, keep audit logs of all changes to binary files and essential configs and make sure the audit logs are immutable.</FONT></FONT><BR>
<BR>
<FONT SIZE="2"><FONT COLOR="#000000">Keep an eye on the system for a while to make sure you haven't missed anything.</FONT></FONT><BR>
<BR>
<FONT SIZE="2"><FONT COLOR="#000000">Keep LVM snapshots of your OS LVs.</FONT></FONT><BR>
<BR>
<BR>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<FONT COLOR="#000000">I'd Frank Cox' - you can't trust anything on the system now (e.g. how can you be sure that the rpm, bash, ls, ps binaries and various kernel modules haven't been replaced to hide some processes and files? That the boot loader haven't been tweaked to run some snooper or who knows what?) </FONT><BR>
<BR>
<FONT COLOR="#000000">The only benefit of investigating the current system is in learning what went wrong, report bugs and maybe change configuration in the reinstalled system, but other than that you shouldn't allow one bit of it to touch a CPU, so to speak. </FONT><BR>
<BR>
<FONT COLOR="#000000">--Amos</FONT><BR>
</BLOCKQUOTE>
<BR>
<PRE>
I agree. Drives have been removed for evidence preservation and that machine will be rebuilt.
I do appreciate all the suggestions which increases my knowledge level and hopefully I'll lock
it down a bit tighter next time. BTW, traced the culprit IP to Romania.
</PRE>
<BR>
Thanks again.<BR>
<BR>
B.J.<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
CentOS 5.0, Linux 2.6.18-8.1.15.el5 x86_64 19:53:46 up 14:13, 1 user, load average: 0.04, 0.06, 0.02
</TD>
</TR>
</TABLE>
</BODY>
</HTML>