Cybersecurity

Fantastic news...

A friend has an old Sun box to spare.

I'd like to setup the box to serve the sites on the hacked server,
but I don't want to leave the same holes open...

How can I setup this box to take the place of the current?

Of course I need more security than I currently have/had...

The box will only be serving pages til late july when I plan to
go down to the facility to see what's up... (and redo my box)

At that time I will be starting from scratch again, sort of...
the boxes are the same, plan on keeping bins on the remote
nfs system, the question:

Where should I look (hacked server log files) to find the hole?

I don't know exactly how you are set up but here are a few pointers.

(Assuming the cd backup can be brought up to allow compares of files) Compare the checksum (man sum) information for all files. Write a script to check them and output the ones that are different.

Start reading - check out the links provided in earlier messages - The folks responding to your questions are not responsible for your system - you are. You need to get up to speed by doing some research. Search the web for Solaris security, hardening Solaris, check out SunSolve's security, insure the recommended security patches are on.

Once you get an idea of what you need and what you don't, turn off services via /etc/inetd.conf. Get ssh installed on the system so you are getting to the system via a secure connection (well, more secure than telnet). Turn off telnet - you don't need it for Sendmail (assuming this is ALL that this server is suppose to be doing).

If you have a separate /usr partition, mount it read-only, if possible. You and any hacker will not be able to change anything in that partition unless the system /etc/vfstab is changed and the system rebooted.

Run a checksum against all files systems that should not have changes - there used to be a program from SUN but I don't remember the name.

If Solaris 7 does not have Sunscreen Lite as a 'free' product, install Solaris 8 on the new server and use Sunscreen Lite. If you can push buying a firewall product, then do that (you now have the case/documentation of why it's worth it)