Re: sendmail compromised - Somebody help me!

From: Ohmster (notareal_at_emailaddress.com)
Date: 04/30/05 

Date: Sat, 30 Apr 2005 15:30:21 GMT

"Bev A. Kupf" <bevakupf@myhome.net> wrote in
news:slrnd70gil.j7n.bevakupf@myhome.net:

> When you do that, you should install or make use of something like
> logrotate, so you don't end up with such large log files, which as
you've
> learned are hard to peruse through.

I have logrotate in place, that is why I get 4 of each log. This was such
a massive spam attack that I guess it overwhelmed the logs. With 3
domains, each making logs, it adds up.
 
> Chalk this one up to experience - you've made a good decision in
> deciding to do a fresh install.

Yes, I just found out that I had backdoors on the system. phpbb 2.0.6 no
doubt was the culprit. /var/tmp (Which I don't think even belongs on
redhat 9) was chock full of them. Michael found PsychoPhobia Backdoor,
Mungo found rst.b. There is a visa card phishing program, and other
stuff. This is just too much, you were right Bev, the box has no place on
the net, is outta there now. Cannot ever use that system again now. No
way.
 
> Also, invest time in developing a backup system. I'll tell you
> what I do. I make a complete backup on tape media every four
> weeks, and an incremental backup every week. If you don't have
> a tape device, you can use a removable HD, they're cheap .....

Will do.
 
> Beverly

Hope that you did not take the "hissy fit" personal, I did not intend to
launch it at you. You always had my respect, you were the one to get me
this far. Thanks Bev. 

-- 
~Ohmster
ohmster at newsguy dot com

Relevant Pages