[PLUG] Got hacked last night - HELP!

[Michael Rasmussen]

On Mon, Oct 04, 2004 at 04:23:42PM -0600, Bill Thoen wrote:
> Well, lucky me. My RH 8 box got hacked again. That makes Linux just as 
> insecure as Windows. The only visible damage (so far) was that my home web 
> page got changed to "un-root crew ownz you."
> 
> What else should I check? At the very least how do I keep 63.164.60.12 out
> of my SSH system?

Unplug from the net
configure IP tables
get chkrootkit - http://www.chkrootkit.org/
clean system
run rpm -Va and figure out anything that fails the comparison

that's a start
-- 
    Michael Rasmussen, Portland Oregon  
  Be appropriate && Follow your curiosity
 http://meme.patch.com/memes/BicycleRiding
   Get Fixed:  http://www.dampfixie.org
  The fortune cookie says:
Nasrudin called at a large house to collect for charity.  The servant said
"My master is out."  Nasrudin replied, "Tell your master that next time he
goes out, he should not leave his face at the window.  Someone might steal it."