Re: Attempts to push spam through apache

From: Wayne Frazee (w.frazee_at_securenetworksystems.com)
Date: 08/23/04

  • Next message: Adrian Popescu: "Re: Attempts to push spam through apache" 
    To: Adrian Popescu <adixpope@rdsnet.ro>
Date: Sun, 22 Aug 2004 22:11:13 -0600

    When a box gets compromised, its a good idea to strip it down. I think
    I saw it termed as "burning it down and paving over it" or something of
    that ilk. I realize that in the real world, that of course is not
    always possible ;)

    Anyway, my point: A rootkit scan should be a daily cronjob on any DMZ or
    public services server. I personally prefer rkhunter due to the fact
    that you can customize output for console or cronjob usage, and its
    relatively frequent updating and heuristic scanning.

    This of course, should be complimentary to other security measures and
    works in tandem with firewall rules, a network IDS, properly configured
    servers, and any measure of custom tools (I find that portsentry, when
    properly configured for the services running on the server, is a good
    one to run on servers as well). 

    -- 
-----------------
Wayne S. Frazee
On Sun, 2004-08-22 at 03:09, Adrian Popescu wrote:
> use "chkrootkit" tool , or other programs (run it a couple of times).
> Also look in /tmp or other places where Apache (User/Group)
> are able to write and see if there is any trace left.

  • Next message: Adrian Popescu: "Re: Attempts to push spam through apache"