Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Gentoo User (http://www.linux-archive.org/gentoo-user/)
-   -   I've been hacked. (http://www.linux-archive.org/gentoo-user/369327-ive-been-hacked.html)

Grant 05-11-2010 04:58 AM

I've been hacked.
 
I nmap'ed one of my remote Gentoo servers today and besides the
expected open ports were these:

1080/tcp open socks
3128/tcp open squid-http
8080/tcp open http-proxy

I'm not running any sort of proxy software that I know of and I should
be the only person whatsoever with access to the machine. 'netstat
-l' doesn't show any info on those ports at all so I suppose it's been
hacked as well? I installed and ran 'rkhunter --check' (what happened
to the chrootkit ebuild?) but it doesn't seem to be much use since I
hadn't established a "file of stored file properties".

What do you guys think is going on? What should I do from here?

- Grant


All times are GMT. The time now is 07:09 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.