Re: a weird script worm uploaded via php with debian 3.0 ?
On Tue, Jun 10, 2003 at 02:58:27PM -0500, Robert Ebright wrote: > Hello, > I logged in to my server today to find that > /usr/sbin/ncsd was running about 50 copies, > since I don't have BIND installed, obviously > something was up...they were also running with > the user www-data... > After a little bit of research I found a new > crontab entryFile: /tmp/crontab.LYukbF > 0 * * * * /tmp/.nscdrecover Hi I dont have any information about your trojan, but i can give you a solution (also a good security practice) Mount /tmp in a separate partition with the noexec flag in fstab This will disable most of the trojans Best regards -- Celso González http://bulmalug.net pgpt17oO6xoxf.pgp Description: PGP signature
Re: a weird script worm uploaded via php with debian 3.0 ?
On Tue, Jun 10, 2003 at 02:58:27PM -0500, Robert Ebright wrote: > Hello, > I logged in to my server today to find that > /usr/sbin/ncsd was running about 50 copies, > since I don't have BIND installed, obviously > something was up...they were also running with > the user www-data... > After a little bit of research I found a new > crontab entryFile: /tmp/crontab.LYukbF > 0 * * * * /tmp/.nscdrecover Hi I dont have any information about your trojan, but i can give you a solution (also a good security practice) Mount /tmp in a separate partition with the noexec flag in fstab This will disable most of the trojans Best regards -- Celso González http://bulmalug.net pgp0.pgp Description: PGP signature
Re: spam block
On Tue, Apr 15, 2003 at 02:47:52PM +0200, Konstantin wrote: > hi, > > I need a spam filter, but I need one which works with sendmail and is not > spamassasin(the system needs an old perl 5.0.X), but spamassasin needs perl > >5.6 > > any ideas, which spam filter I can use on such a system. Try with bogofilter Best regards -- Celso González [EMAIL PROTECTED] http://bulmalug.net