[BlueOnyx:12276] Re: Kernel 0-day vulnerability + SSHd Spam Exploit(libkeyutils.so.1.9)

[Eiji Hamano]

Hi

I don't want to have misunderstanding.

In general,  when "have been rooted" time,
the user must migrate old one to new one ASAP,  and  have to stop old one 
immediatly.

Just my mere understanding.  Don't care it.
Eiji Hamano


> What didn't accept? You can use iptables on (almost) any Linux box 
> including BlueOnyx.
>
>> Why ?  You said :
>>>> don't trust any data on the old  box and start fresh.
>
> Iptables etc (whilst good practice) doesn't actually fix the problem. 
> Seeing a damaged box allows two things:
>
> 1) To work out how they got in
> 2) To work out what they have done as a result
>
> Both of these are useful in defending boxes, and preventing it being 
> possible in the first place.
>
> Steve