Re: ftp problem

[Kalum / Grendel <kalum lintux cx>]

On  Mon, 23 Apr 2001, Ian Northeast commented thusly,

> "Jim M." wrote:
> > 
> > Hi,
> > I updated my ftp to one of the latest as the result of roman worm intrusion
> > and now
> > i can not ftp to my linux box within my own lan. What is wrong?.
> > hosts.allow is:
> > portmap xxx.xxx.0.0
> > 
> > I donot have /etc/hosts.deny as roman worm deleted it.
> > what is the best hosts.deny as this RH box is a gateway to internet.
> 
> Wipe it out and reinstall it NOW.

Excellent advice, what I would suggest to is to, delete the ext2
partitions and reinstall from scratch, connect to the internet and
automatically immediately update your rh distro, once everything is secure
please install a firewall, and keep only the minimum  of ports necessary
open. For example on my home machine I only keep the ssh port open. 
 
> You don't know what else the Ramen worm did.

It allways helps to have a app like tripwire installed to see what a
hacker has done, ie what files that the insecure punk has modified on your
system.

Best Wishes,
Grendel


-- 
.---------------------.---------------------.----{)--.
| /"__ ._ _  _  _| _ |`- grendel lintux cx -'(]__/|| |
| \__/ | (-'| |(_|(-'l_ `-===============-' [_]  .-: |
`--------------------------------------------/|\/| |-'

all your chix are belong to us.