compromised server
From: jahmon (jahmon_at_jahmon.com)
Date: 08/28/03
- Previous message: Andrew McNaughton: "source addresses for IP traffic between jails"
- Next in thread: Guy P.: "Re: compromised server"
- Reply: Guy P.: "Re: compromised server"
- Maybe reply: Devon H. O'Dell: "Re: compromised server"
- Reply: James: "Re: compromised server"
- Reply: Joe Warner: "Re: compromised server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 28 Aug 2003 10:41:59 -0400 To: freeBSD-security@freebsd.org
I have a server that has been compromised.
I'm running version 4.6.2
when I do
>last
this line comes up in the list.
shutdown ~ Thu Aug 28 05:22
That was the time the server went down.
There seemed to be some configuration changes.
Some of the files seemed to revert back to default versions
(httpd.conf, resolv.conf)
Does anyone have a clue what type of exploit they may have used?
Is there anyway I can find out if there are any trojans installed?
Thanks
jahmon
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
- Previous message: Andrew McNaughton: "source addresses for IP traffic between jails"
- Next in thread: Guy P.: "Re: compromised server"
- Reply: Guy P.: "Re: compromised server"
- Maybe reply: Devon H. O'Dell: "Re: compromised server"
- Reply: James: "Re: compromised server"
- Reply: Joe Warner: "Re: compromised server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
