Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 42)

The steps to take, in this order:

Pull the plug and disconnect the machine. You may be unwittingly participating in criminal activity,

and doing to others what has been done to you.

•

Depending on the needs of the situation and time available to restore the system, it is advantageous to

learn as much as you can about how the attacker got in, and what was done in order to plug the hole

and avoid a recurrence. This could conceivably be time consuming, and is not always feasible. And it

may require more expertise than the typical user possesses.

•

Backup important data. Do not include any system files in the backup, and system configuration files

like inetd.conf. Limit the backup to personal data files only! You don't want to backup, then

restore something that might open a backdoor or other hole.

•

Re−install from scratch, and reformat the drive during the installation (mke2fs) to make sure no

remnants are hiding. Actually, replacing the drive is not a bad idea. Especially, if you want to keep

the compromised data available for further analysis.

•

Restore from backups. After a clean install is the best time to install an IDS (Intrusion Detection

System) such as tripwire (http://www.tripewire.org).

•

Apply all updates from ftp://updates.redhat.com. •

Re−examine your system for unnecessary services. Re−examine your firewall and access policies,

and tighten all holes. Use new passwords, as these were stolen in all likelihood.

•

Re−connect system ;−) •

At this time, any rootkit cleanup tools that may be available on−line are not recommended. They probably do

work just fine most of the time. But again, how to be absolutely sure that all is well and all vestiges of the

intrusion are gone?

Security Quick−Start HOWTO for Red Hat Linux

6.3. Reclaiming a Compromised System 39

1 2 ... 37 38 39 40 41 42 43 44 45 46 47 ... 81 82

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 42