Really doing anything except wiping completely and then reinstalling is risky, it is VERY hard to know what all they did to the server (left backdoors etc.). You should start from scratch & make sure that you are secure, obviously it wasn't before. Can you be sure that there aren't other security flaws left from the previous admin? You also may want to look into using SSH(SFTP) to transfer files, to be more secure(FTP sends passwords clear text). If your setup is inflexible to too going to SFTP you may want to set it up to use a SSH tunnel to protect the FTP traffic, if you need help with setup let me know and I will point you in the right direction.
If your boss doesn't want to start from scratch because of the time you should point out that getting hacked again would probably be a bigger loss of time. ----- Original Message ----- From: "Rick Klinge" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, January 15, 2004 12:09 PM Subject: RE: [IMail Forum] OT reading FTP login attempts Rebuilding is simple.. Wipe the drives and start from scratch.. ~Rick I have to rebuild a compromised server (was not under my control before :-) There are out several webcams all with their own ftp logins connecting to this server. I have no information about the preliminarily existing logins (username/password) The only thing I immagine I can do (except reconfiguring any single webcam) is to set up the new server and "listen" what login attempts are comming. Any idea how to visualize the password transmitted from the webcams? Should I install something like a password sniffer (any reccomandations?) or is there out a simple ftp server that allows to see the login attempts with username AND password? ___________________________________________________________________ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
