[aclug-L] Problems

["Dale W Hodge" <dwh@xxxxxxxxxxxxxxxx>]

Hello guys! I've got some problems and I'm looking for advice in how to
deal with them. 

Sometime in the past few days, somebody exploited a weakness in my web
server, overwrote the index.html files on all my domains. About the same
time, it appears they appear to have utilized the mailer capabilites of
the webserver to mail out in excess of 10,000 pieces of spam! It was
when the bounce messages started flooding my mailbox that I realized I
had a problem.  There's no evidence that anyone gained root access, it
looks like it was just a webserver exploit. 

The question is how best to secure the server and prevent this from
happening again. I'm not sure just what they exploited, whether it was
in apache itself, or in the post-nuke code running on it. 

I'm open to suggestions at this point.

--Dale


-- This is the discussion@xxxxxxxxx list.  To unsubscribe,
visit http://www.complete.org/cgi-bin/listargate-aclug.cgi