Re: [cobalt-users] [RAQ3] Server down - suggestions please?!??

["Dave Reid" <dave@xxxxxxxxxxxxxxxxxxxxx>]

----- Original Message -----
> I've got a server down - the symptoms were that all name related
services stopped - I've not installed any software lately, in-fact,
nothing since 1st of Feb, and there have been reboots since then.
>
> On the server, mail isn't working, DNS is not starting up, the
machine is also running VERY slow, and it was running wild with memory
earlier - ie, it used all physical RAM and about 10% of swap - my
hosting company said that I needed more ram, which I knew to be false,
but to keep them quiet I got them to install 128Mb of extra ram in the
spare slot - no difference!
>
> Later today, the box went competely nuts again, and used all 192Mb
of physical RAM and again, about 10% of available swap.
>
> Now I have a box that won't start mail or named on startup, or from
the shell, plus about 60 hosting clients on the box, all on IP
hosting, and none of their sites can be seen - HELP!!!!
>
------------------reply-----------------------
When this happened to our raq3, it was due to us being hacked into.
They got in through the BIND exploit. I am not sure the exact fix,
because tech support was supplied by the company we lease our server
from. You could run some checks on your package files. I don't have
the exact commands here, they are at the office. If you still need
help with this, let me know, and I can grab my docs. Hope this helps.
--------------------------------------------------------------------
Cheers, Dave Reid (Night Rider)
Never engage in a battle of wits unarmed
--------------------------------------------------------------------