snarg Wrote:....see any of the theards of the UJ hacker??
what were they about??
in quiring minds want to know
narg:
2nd with SanDog on that it's truly weird how they reacted, I mean upon what's happenned the minimum thing I would do is to totally reinstall the whole server (I don't think they are collocating).
<---technical babbling---->
Ideally using a really secure linux distro.
I tried "EnGarde" at work, works flawlessly and really secure (no gcc, perl,...) most of the filesystem part is locked in readonly mode (a part a few dir like the logs...) and the only way to connect is through SecureTelnet. Mail server works in secure pop and so on. However you can setup unsecure connections but it isn't a good idea if you haven't a non public administrative ip interface.
My best thoughts to WEB setup a secure environment :
- OS : linux
- vpn access + radius
- Secure FTP/Telnet
- FileSystem ReadOnly mode (not sure but the package is named "finestra")
- no c compiler/perl interpreter
- Tweaking the apache config to unload all unneccessary modules (apache 1.3... not the lousy 2.0 one)
- Looking at the mysql config to strenghten it
- Patche regularly php/apache/mysql/system...
...And once it's all ok I create a bootable cd with all the system on it, lauch the server from it. (so this way even if the machine got massively haxored he wont have the possibility to alter the stuff).
Ok this is a lot of work but it keeps script kiddies away and if a dude could still enter the system I'm sure that you'll have to watch first if your computer wasn't compromised, if not I would mean that you have been attacked by a *true hacker*.
DoublePlus they have a nice webadmin interface (accessible through https only by the secured leg) with lot of reporting.
Looks like they are going to release a new version soon.
<---/technical babbling---->
if the hacker keeps coming back it's more like the whole machine got compromised (and not only the web front end).
![[Image: line.gif]](http://www.goranot.com/jokes/line.gif)
