RE: [cobalt-users] Howto trace hack

["Crocket" <crocket@xxxxxxxxxxx>]

> We tend to see this exploit regularly.., not only in that gallery module,
> also in poorly programmed PHP scripts by customers..
> This type of hack is the one that is 99% of the (attempted) hacks on our
> servers..

> It ususally ends there.., due them trying to set up an irc or ftp server,
> which in turn is blocked by the firewall..

Hi Jeroen,

We've asked Gerald to install his Security package on this server like he
did on our other servers. Thanks Gerald for the quick service ;-).
This server was still in the progress of getting all vhosts copied to from a
raq4 so we hadn't come to that security part yet.
But it's another lesson to not postpone such an important part on future
server adds.

Now my question, is the included firewall blocking things like that from now
by default or is there anything to configure ?
I don't mean the gallery exploit itself but the install of unwanted software
at unwanted places ...

Thanks for the help list!
John