----- Original Message ----- From: "Sean Dague" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, July 15, 2003 10:37 PM Subject: Re: I've been hacked!! (was Re: [mhvlug] One more question.....(yeah, sure))
> > Just out of curiosity, what was your indication that you were hacked? > I got up in the AM after leaving the router sys and my game sys on to download a few albums and saw that the network was running full throttle (downloads having been long completed). I killed the connection and disconnected the two systems from the network. When I looked around on them I found strang files created on the 15th and strange file names and log files change alerts etc. > > One of my problems is I don't really know > > what rules Firestarter loads by default. I was trusting to faith that they > > were "good enough", was having another issue that I was addressing via the > > ng comp.os.linux.security and had a couple of other people ask "what rules > > are you running?" at which point I realized I better find out.....but not in > > time. > > I haven't heard of Firestarter. Is there a URL for that? I use Shorewall > by default on my Mandrake box, and after taking about an hour to learn the > config files, it is pretty straight forward. > http://firestarter.sourceforge.net/index.php Well, if it took you an hour it'll take me a bit longer. My next linux firewall is going to start with Deny all and go from there. (Even though it's not Peter anymore I have more trust in Nortons right now then my own knowledge..... A situation I hope to change soon....(I want my linux router/firewall back, if for no other reason then, even though it was running on a slower system (linux --> P233 sys vs. W2K --> 2XCel 533) My connections appeared to be faster through the Linux box). > > So...I'm back to running a W2K sys (the one that was supposed to be my web > > and game server :-( ) with Norton's Internet Security (I actually loaded > > it on ALL my windows systems) until I have more knowledge of setting up a > > secure firewall on Linux. > > _______________________________________________ mhvlug mailing list - http://mhvlug.org [EMAIL PROTECTED] http://lists.dague.net/mailman/listinfo/mhvlug
