Re: [cobalt-users] Emergency problem !!

["Graeme Fowler" <graeme.f@xxxxxxxxxxxxxxx>]

Martin Smit wrote:
> My provider sent me the following email:
<snip>
> This was in regard to your ticket:
> Unauthorized use of IP address.  No idea what ipadress he means but
anyway
> when I checked what happened I found out that apache is not running
anymore.

Sounds to me like your machine has been cracked and the provider has
noticed it before you did :(

Single-user mode is a method of booting the machine so a sysadmin can
have a good poke around to see what damage has been done. I have to do
this far too regularly with both RaQs and Linux boxes.

I'll wager that your RaQ has been compromised via (a) the Wu/Pro-ftpd
overflow hole, or (b) an RPC exploit, but let's wait and see what your
provider says first.

Graeme