Re: [cobalt-developers] HELP HELP

["Brian Curtis" <admin@xxxxxxxxxxx>]

> After the hacking, i have horrible problems:
>
> [root@ns /]# /sbin/shutdown
> /sbin/shutdown: error in loading shared libraries: /sbin/shutdown: symbol
,
> vers
> ion GLIBC_2.0 not defined in file libc.so.6 with link time reference
>
> I tried to recompile the kernel and it worked, but didnt fix this?
>
> All services seem normal but FTP? Its VERY SLOW right after USER username
>
> its like he deleted it off my system? no /etc/rc.d/init.d/ftpd
> no /etc/rc.d/rc3.d/SxFTP?
>
> ??
>
> Anyone?


If you suspect a security compromise, you should take the box offline and do
some further inspection of the logs and see if you can find out how this
person "broke in".  Are there any abnormal users logged in?  What about a
netstat -an?

If this is an important box, you could dump the entire drive contents to
another drive (which can be mounted in any linux box for inspection), and
use the restore cd and a known good backup.  However, you cannot be
guaranteed that this person isn't exploiting a security hole that exists
within the Cobalt setup.  If they are, then they will most likely hack back
into the box once back online.

--
BC