[luau] RH 9 server hacked -- what went wrong?

[Vince Hoang]

On Fri, Aug 22, 2003 at 11:26:25AM -1000, Ho'ala Greevy wrote:
> chkconfig --list | grep 3:on
> 
> 
> will reveal better results.  Init3 is the run level you want to
> concentrate on.

Respectfully, I disagree. You want to reduce the running services
on all your runlevels. Most of the RH installations I have seen
boots at runlevel 5 and have GDM startup.

> Rob, would you mind sharing the IP of your cracked box before
> you blow it away? i'm sure at least one of us wouldn't mind
> running nessus against it :)

Not while IRC drones are running on it. Unless you like playing
with fire, do not keep a compromised system running. Swap out the
drive and reinstall.

Save nessus for the systems that you do not yet think are
compromised.

-Vince