Re: HELP, my Debian Server was hacked!

2003-04-24 Thread Dale Amon
On Wed, Apr 23, 2003 at 10:44:34AM -0400, James Duncan wrote: Obviously steps should be in place to mitigate the damage of these sorts of acts. Have steps in place to quickly replace machines that have to be removed from production quickly and without warning. Use syslog to log locally AND

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread Mauro Chiarugi
Il Tue, 22 Apr 2003 17:48:23 -0500 (CDT) David Ehle sì che favelando sibillò: nightly apt-get update apt-get upgrade But if it asks human interaction?? How can i do?? -- sracatus

Re: Re: HELP, my Debian Server was hacked!

2003-04-24 Thread I.R. van Dongen
lamorak:~# crontab -l @daily apt-get -q -q -q -q update apt-get -s -q -q -q -q dist-upgrade make sure the output is mailed to an address you use daily. When an update is available you will be mailed, otherwise you get no mail. Gr, Ivo van Dongen On Thu, 24 Apr 2003 11:19:34 +0200,

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread Nicolas Sulek
you can use cron-apt cron-apt - Automatic update of packages using apt Mauro Chiarugi wrote: Il Tue, 22 Apr 2003 17:48:23 -0500 (CDT) David Ehle s che favelando sibill: nightly apt-get update apt-get upgrade But if it asks human interaction?? How can i do?? --

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread David Ramsden
On Thu, Apr 24, 2003 at 11:19:34AM +0200, Mauro Chiarugi wrote: Il Tue, 22 Apr 2003 17:48:23 -0500 (CDT) David Ehle s? che favelando sibill?: nightly apt-get update apt-get upgrade But if it asks human interaction?? How can i do?? apt-get --assume-yes upgrade That'll answer 'yes' to

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread Mathias Gygax
On Don, Apr 24, 2003 at 11:19:34 +0200, Mauro Chiarugi wrote: Il Tue, 22 Apr 2003 17:48:23 -0500 (CDT) David Ehle sì che favelando sibillò: nightly apt-get update apt-get upgrade But if it asks human interaction?? How can i do?? from the apt-get manual page: [...] -y

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread tps
On Thu, Apr 24, 2003 at 04:02:56AM +0100, Dale Amon wrote: On Wed, Apr 23, 2003 at 10:44:34AM -0400, James Duncan wrote: Obviously steps should be in place to mitigate the damage of these sorts of acts. Have steps in place to quickly replace machines that have to be removed from production

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread François TOURDE
Le 12166ième jour après Epoch, Nicolas Sulek écrivait: !DOCTYPE html PUBLIC -//W3C//DTD HTML 4.01 Transitional//EN html [SNIP...] /html Please, please, please... No HTML in text messages... Even if you run NT on your box :) -- QOTD: What I like most about myself is that I'm so

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread François TOURDE
Le 12166ième jour après Epoch, Mathias Gygax écrivait: On Don, Apr 24, 2003 at 11:19:34 +0200, Mauro Chiarugi wrote: Il Tue, 22 Apr 2003 17:48:23 -0500 (CDT) David Ehle sì che favelando sibillò: nightly apt-get update apt-get upgrade But if it asks human interaction?? How can i

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread David Ehle
Il Tue, 22 Apr 2003 17:48:23 -0500 (CDT) David Ehle sì che favelando sibillò: nightly apt-get update apt-get upgrade But if it asks human interaction?? How can i do?? I use a cronjob. I'll send it to you privatly, if anyone else wants it let me know. David. -- sracatus -- To

Re: Re: HELP, my Debian Server was hacked!

2003-04-24 Thread Adam ENDRODI
On Thu, Apr 24, 2003 at 11:43:06AM +0200, I.R. van Dongen wrote: lamorak:~# crontab -l @daily apt-get -q -q -q -q update apt-get -s -q -q -q -q dist-upgrade Before you deploy such a mechanism, I advise that you set up another one between the update and upgrade which checks the

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread Nicolas Sulek
I'm really sorry, I didn't notice that when I wrote my message François TOURDE wrote: Le 12166ième jour après Epoch, Nicolas Sulek écrivait: !DOCTYPE html PUBLIC -//W3C//DTD HTML 4.01 Transitional//EN html [SNIP...] /html Please, please, please... No HTML in text

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread Raymond Wood
On Thu, Apr 24, 2003 at 02:17:48PM +0200, Adam ENDRODI imagined: On Thu, Apr 24, 2003 at 11:43:06AM +0200, I.R. van Dongen wrote: lamorak:~# crontab -l @daily apt-get -q -q -q -q update apt-get -s -q -q -q -q dist-upgrade Before you deploy such a mechanism, I advise that

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread simon raven
Le Thu, Apr 24, 2003 at 08:48:27 -0400, Raymond Wood a écrit: On Thu, Apr 24, 2003 at 02:17:48PM +0200, Adam ENDRODI imagined: On Thu, Apr 24, 2003 at 11:43:06AM +0200, I.R. van Dongen wrote: lamorak:~# crontab -l @daily apt-get -q -q -q -q update apt-get -s -q -q -q -q

WAS: HELP, my Debian Server was hacked!

2003-04-24 Thread I.R. van Dongen
this crontab does not download any packages, notice the -s switch which simulates the download en install process. it merly tells you what it would download and install if you would leave out the -s switch. Gr, Ivo van Dongen PS I would really like to see you perlscript, if you could send

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread David Ramsden
On Thu, Apr 24, 2003 at 01:16:49PM +, simon raven wrote: Le Thu, Apr 24, 2003 at 08:48:27 -0400, Raymond Wood a ?crit: On Thu, Apr 24, 2003 at 02:17:48PM +0200, Adam ENDRODI imagined: [snip] Details on how to implement this have been discusssed in the list several times and an

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread James Duncan
On Thu, 24 Apr 2003, Dale Amon wrote: On Wed, Apr 23, 2003 at 10:44:34AM -0400, James Duncan wrote: Obviously steps should be in place to mitigate the damage of these sorts of acts. Have steps in place to quickly replace machines that have to be removed from production quickly and without

Re: WAS: HELP, my Debian Server was hacked!

2003-04-24 Thread Kay-Michael Voit
IRvD PS I would really like to see you perlscript, if you could send it to me personallyI would really apriciate it. place me on the list, too, please. IRvD On Thu, 24 Apr 2003 14:17:48 +0200, [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2003 at 11:43:06AM +0200, I.R. van Dongen wrote:

Re: WAS: HELP, my Debian Server was hacked!

2003-04-24 Thread Mauro Chiarugi
Il Thu, 24 Apr 2003 15:27:28 +0200 (CEST) I.R. van Dongen sì che favelando sibillò: PS I would really like to see you perlscript, if you could send it to me personallyI would really apriciate it. me too :) thanks a lot!! bye -- sracatus

Re: HELP, my Debian Server was hacked!

2003-04-24 Thread Mauro Chiarugi
Il Thu, 24 Apr 2003 07:03:48 -0500 (CDT) David Ehle sì che favelando sibillò: I use a cronjob. I'll send it to you privatly, if anyone else wants it let me know. David. Thanks a lot, i'll be happy to see it. -- sracatus

Re: WAS: HELP, my Debian Server was hacked!

2003-04-24 Thread Dale Amon
On Thu, Apr 24, 2003 at 04:18:10PM +0200, Kay-Michael Voit wrote: IRvD PS I would really like to see you perlscript, if you could send it to me personallyI would really apriciate it. I guess I'd not mind double checking that I haven't missed something and should add it to my cfengine2

Re: WAS: HELP, my Debian Server was hacked!

2003-04-24 Thread Sebastian
perl script for automatic updates... secpack does what you are looking for: http://therapy.endorphin.org/secpack/ Sebastian

Re: WAS: HELP, my Debian Server was hacked!

2003-04-24 Thread Erick Lopez Carreon
I.R. van Dongen sì che favelando sibillò: PS I would really like to see you perlscript, if you could send it to me personallyI would really apriciate it. I really apreciate if you can share with me your script. Thanks in advance. = Por favor, NO utilice formatos de

RE: HELP, my Debian Server was hacked!

2003-04-23 Thread DEFFONTAINES Vincent
Have a look at the coroner toolkit from Dan Farmer and Wietse Venema. Debian packaged : tct It is advised *not* to turn off your box, maybe you can unplug its network... not sure its a good idea even. http://www.fish.com/tct/help-when-broken-into Chosen extract : What to do --- The

RE: HELP, my Debian Server was hacked!

2003-04-23 Thread James Duncan
On Wed, 23 Apr 2003, DEFFONTAINES Vincent wrote: What to do --- The first 3 basic steps to handling a situation (roughly taken from the wonderful Criminalistics, An Introduction to Forensic Science, by Saferstein (see the bibliography file) are: o Secure and isolate

HELP, my Debian Server was hacked!

2003-04-22 Thread Christian Könning
Hello List, I hope this is not of topic: My private server has been hacked: debian woody 2.4.18bf2.4 kernel, apache-ssl, samba, squid. now my problem: the intruder used a rootkit, i think, cause he deleted /var/log, symlinked /root/.bash_history /dev/null, etc. Is there any way to recover the

Re: HELP, my Debian Server was hacked!

2003-04-22 Thread Javier Fernández-Sanguino Peña
On Tue, Apr 22, 2003 at 09:00:11PM +0200, Christian Könning wrote: Hello List, I hope this is not of topic: My private server has been hacked: debian woody 2.4.18bf2.4 kernel, apache-ssl, samba, squid. Ouch. Was it up-to-date to security patches? now my problem: the intruder used a

Re: HELP, my Debian Server was hacked!

2003-04-22 Thread xbud
tar up your /proc/ directory to save a copy of your kcore - it should have useful information unless he managed to zero out all the memory that was being utilized during the break in. turn the box off but make sure it don't delete crap, watch out for logic bombs or what not. remove the disk

Re: HELP, my Debian Server was hacked!

2003-04-22 Thread David Ehle
While the earlier advice is probably the best advice, don't forget to run chkrootkit. I recently had the same thing happen to one of my machines. I've found a kit in /dev/proc/fuckit The total nuking of /log makes this look like a very amature job. If they were hot they would edit the