You also might try booting the system (off the network) with a distro
like P.H.L.A.K. or FIRE. I know there are a couple other forensic boot
distros, but those are the two I've used most. Any other good
forensic distros out there?<br><br><div><span class="gmail_quote">On 3/22/06, <b class="gmail_sendername">Dave Carlson</b> <<a href="mailto:thecubic@thecubic.net">thecubic@thecubic.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Wednesday 22 March 2006 09:55, Loren H. Burlingame wrote:<br>> I recently noticed that a system I am responsible for was sending out<br>> a bunch of spam messages. I logged into it and sure enough it was a<br>> cracked user account which was responsible.
<br><br>Unplug the network cable, reboot with a utility CD, make a backup image (with<br>dd/tar/whatever) onto another media, and reload from system disks.<br><br>> I immediately locked down SSHD to certain users with strong passwords
<br>> (should have done this before, I know), killed the offending processes<br>> and looked for replaced executables.<br><br>If they've gotten root (which they may have), going through ssh is a burden.<br>They may have installed a rootkit and can still get what they want.
<br><br>> Fortunately, the "hacker" (more like script kiddie) was not able to<br>> get access to root by the look of it. Also they managed to not delete<br>> their .bash_history file.<br><br>Never trust log files when a compromise has happened, unless they're remotely
<br>captured onto a secured host. Even then they can be trusted only up to the<br>compromise.<br><br>Dave Carlson<br><br><br>_______________________________________________<br>TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
<br><a href="mailto:tclug-list@mn-linux.org">tclug-list@mn-linux.org</a><br><a href="http://mailman.mn-linux.org/mailman/listinfo/tclug-list">http://mailman.mn-linux.org/mailman/listinfo/tclug-list</a><br><br><br><br></blockquote>
</div><br><br clear="all"><br>-- <br>-<br>G. Scott Walters<br><a href="http://www.apt518.net">http://www.apt518.net</a><br>