Re: [cobalt-users] Help needed

["E.B. Dreger" <eddy+public+spam@xxxxxxxxxxxxxxxxx>]

R> Date: Mon, 1 Jul 2002 20:07:44 +0800
R> From: Rick


R> There have been worms placed in my server recently.  After
R> clearing my LPD worm yesterday, I saw this today.  Checking
R> `lkm'... You have     5 process hidden for readdir command
R> You have     5 process hidden for ps command Warning: Possible
R> LKM Trojan installed

Kernel-module worms are not your friend.


R> I would like to know how do i fix this problem of mine from
R> future attacks/worms.

Blow away the machine.  Fdisk from a known-clean floppy, then
reload the OS.  Patch necessary software and delete unused tools
before accepting connections from the Internet.  Stay current on
patches.

Do a Google search using keywords like "hardening" and "bastion"
for more information.

Sysadmin 101.  It's rather un-Cobalt in approach, but it works.


Eddy
--
Brotsman & Dreger, Inc. - EverQuick Internet Division
Bandwidth, consulting, e-commerce, hosting, and network building
Phone: +1 (785) 865-5885 Lawrence and [inter]national
Phone: +1 (316) 794-8922 Wichita

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Date: Mon, 21 May 2001 11:23:58 +0000 (GMT)
From: A Trap <blacklist@xxxxxxxxx>
To: blacklist@xxxxxxxxx
Subject: Please ignore this portion of my mail signature.

These last few lines are a trap for address-harvesting spambots.
Do NOT send mail to <blacklist@xxxxxxxxx>, or you are likely to
be blocked.