On Sun, 2003-02-23 at 09:38, Mike Vanecek wrote: > Someone has ftp'd a file to my incoming folder with the name: > > !! Just a Comment that you may want to READ.txt > > The file permissions were set as rw r r which obviously is not a good thing. > Further, I am unable to less it or delete it. I did change the permissions to > 000 by chmod 000 *. > > This is RH 7.1 running proftpd-xinetd, proftpd-1.2.2-3.5.swsoft. > > How to I get rid of the offending message? > > How do I prevent it from happening again? > > Thanks, Mike. >
as for the file, look at the extended attributes with lsattr I is probably set with the i ( immutable) flag chattr -whateverflag flag should remove whatever it is set to. As to the how, you have been hacked. There are lots of threads in this list on what to do. to secure your box. See the archives at http://marc.theaimsgroup.com/?l=redhat-list -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list
