Re: [cobalt-users] how do the hackers find your Raq?

["Dylan Smith" <dyls@xxxxxxx>]

> click a mouse and paste text into a shell program.  Fun, eh?  I don't know
> how many are seeking out Cobalt boxes, but it wouldn't be hard to find
them
> if there's a known exploit that affects a Cobalt box

I suspect they are not specifically targeting Cobalt systems, but systems
using DeadRat...erm, I mean RedHat Linux. Cobalt Linux is a derivative of
RedHat, and has inherited its security holes.

The most common ones seem to be sunrpc (port 111) - I suspect most of us
don't run that (I certainly don't - the vast majority of kiddie scans seem
to be against 111), lpd (the printer daemon, most of us probably don't run
it either), and named (and a lot of us probably do run that one).

As an additional precaution to just having the latest security patches, try
and run daemons that don't require root access as a non-root user. I require
named (ie BIND), but I run it as a non-root user.