RE: [cobalt-security] Qubes - hacked

["Randy Russell" <rrussell@xxxxxxxxxxxxxx>]

When trying to restart the httpd under /etc/rc.d/init.d

I get this:

[root init.d]# ./httpd restart
 : httpd
 : httpd
[root init.d]#

Help! Time to go sleep now.  :-)



-----Original Message-----
From: cobalt-security-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of Michael
Stauber
Sent: Wednesday, April 30, 2003 4:45 PM
To: cobalt-security@xxxxxxxxxxxxxxx
Subject: Re: [cobalt-security] Qubes - hacked


Hi Randy,

> I was in the same boat when one after another of my client's Qube3 was
> starting having problem It was the week before Easter and on. It was very
> stressful. One of the hack Qube3 was missing the Smb files.

The Samba on a fully patched Qube3 is samba-2.2.2-C1 and Squid is
squid-2.4.STABLE6-C1Q3. I'm not sure which patches were backported, but I
have the nagging feeling that either an enabled Samba or Squid server could
be the culprit.

I have a couple of Qube3's behind a dedicated firewall and only allow web,
email and SSH traffic from the outside and haven't had any problems - even
though one of the boxes is awfully behind on patches.

> I love the Blue Box because it's a great solution for SOHO.

It sure is. A more modern Qube is pretty high on my wish-list. Larger disks,
2.4 Kernel and stuff like a built in PDF-Printer (through Samba and
Ghostscript) and a better built in firewall <sigh>.

--

With best regards,

Michael Stauber

_______________________________________________
cobalt-security mailing list
cobalt-security@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-security