RE: [LUG] breakin...

["Ian P. Christian" <pookey@xxxxxxxxxxxx>]

> Over port 1427/1428. of all the things to pick this up sshd 
> did !! odd !

Ermm... Exactly what service do you have running on those ports that was
compromised?

> What is the best way of finding the ISP of the offender ??

Yeah, www.samspade.org is my favorate for it. 
> They also (somehow) disabled my ability to login under tty1-6,
> i can still get in via X tho !! any ideas ?

Check :

/etc/securetty
/etc/inittab


--
The Mailing List for the Devon & Cornwall LUG
Mail majordomo@xxxxxxxxxxxx with "unsubscribe list" in the
message body to unsubscribe.