Re: [cobalt-security] are these worm files?

[Gossi The Dog <gossi@xxxxxxxxxxxxxx>]

On Mon, 26 Mar 2001, Tsukaeru.net wrote:

> Which patch is the appropriate patch...? I have all the latest RAQ4 patches
> and installed portsentry. Should this cover it?

It depends on how bleh-bleh person got into the system as to which patches
you need to apply.  If you applied one of the earlier bind .pkg's you may
need to restart the named service for it to take effect.

I'd personally recommend making sure proftpd, sendmail, named and SSH are
up to date.  If you can get away with it, disabling the web administrator
interface might also be a good idea.

Anyway, if you have t0rn or similar running chances are there are
rootshells all over the box that need cleaning.

Anyway, 3am in the UK so I'm off to bed.
Gossi.