[Gllug] Have I been compromised?

[Xander D Harkness]

On Sun, 2003-03-23 at 17:51, Adrian McMenamin wrote:
> I have a remote web server that is behaving oddly.
> 
> I can ping it, and it appears to accept connections on port 80.
> 
> But it no longer delivers any content (just hangs for ever until client
> times out) and I can also no longer connect on port 22 (just hangs
> again, without even prompting me for a username) - but if I telnet to
> port 22, the remote machine actively terminates the connection,
> suggesting that sshd is active in some way.
> 
> I will be able to physically examine the system tomorrow am, but I am
> concerned that I have been hacked in some way. What do you think? Any
> means of drawing any conclusions remotely?
Has it been updated with the new glibc?

I have tried restarting sshd on a couple; however ssh would only work
after I rebooted.

Kind regards
Xander
> 
> 


-- 
Gllug mailing list  -  Gllug at linux.co.uk
http://list.ftech.net/mailman/listinfo/gllug