🚀 go-pugleaf

Another place I think is worth checking out is the Abacus Project:

http://www.psionic.com/abacus/

Having had a couple of Linux boxes hacked and modified I'd also look for
other trojans. One of the boxes of mine that was hacked the person
replaced most of the in.* files in /usr/sbin. With more than one box I
was able to compare it to a safe install and do some manual recovery
since I hadn't been running tripwire before then.


Back to the Abacus Project:

	There is a nice little script called Sentry that listens to unused
ports and then based on your instructions 1) adds an IP to hosts.deny
and 2) adds a route to the loopback interface for that address. We even
run it on some production machines and allow users that really need
access to come explain why they were hitting unused ports. It has
several different modes depending upon how tightly you want the system
secured. Note there is a DOS attack possible if you use some UDP modes
(this is documented in the docs but folks still report it as a bug).

Josh