Re: Security/Hacked System - Now what?!!

2013-12-22 Thread Michael Schwendt
On Sat, 21 Dec 2013 19:36:26 -0500, bruce wrote: For sake of discussion, assume a fresh base desktop install of the OS (Fed/RHEL/Centos). After doing the install from the iso(s), you install : -rkhunter -chkconfig Did you mean chkrootkit? If so, it's only for experienced users (who know

Re: Security/Hacked System - Now what?!!

2013-12-22 Thread Wolfgang S. Rupprecht
bruce badoug...@gmail.com writes: And regarding the ssh/remote access, you specify public/private keys, and you have the key process run from the key file. This allows a user to be able to ssh into the box without having to use the ssh passwd, but only from the corresponding box that has the

Re: Security/Hacked System - Now what?!!

2013-12-22 Thread bruce
Wolfgang, Right in what you wrote. And what you wrote allows for ssh commands to be used where you specify the keyFile. However you can also mod the ssh_config (i believe) to have it auto use the keyFile with the pub/private key to negotiate the user/passwd process for the ssh cmd. This is

Re: Security/Hacked System - Now what?!!

2013-12-22 Thread Wolfgang S. Rupprecht
bruce badoug...@gmail.com writes: However you can also mod the ssh_config (i believe) to have it auto use the keyFile with the pub/private key to negotiate the user/passwd process for the ssh cmd. This is useful when remotely/programatically accessing the ssh cmdline process for running

Re: Security/Hacked System - Now what?!!

2013-12-21 Thread Wolfgang S. Rupprecht
bruce badouglas@gma il.com writes: You then mod SSH as required to disable root login OK, what else should you do? Root login isn't a bad idea in and of itself. More important is to not allow anything but public key logins (eg. ECDSA, RSA). For people logging in with root credentials, give

Re: Security/Hacked System - Now what?!!

2013-12-21 Thread bruce
Hi Wolfgang, Ok, say you have a box that you want to remotely access. Never a need to access the box via the gui/login. And regarding the ssh/remote access, you specify public/private keys, and you have the key process run from the key file. This allows a user to be able to ssh into the box