Debian server compromise
Posted by Steve on Wed 12 Jul 2006 at 19:14
Several people have asked for information about the unavailability of one of the Debian projects main servers, gluck. This machine has been taken offline due to being compromised.
This is not the first time that a machine has been compromised, the last time was in November 2003. Then the compromise was detected via the use of a filesystem integrity checker, right now we don't know how this intrusion was detected.
So far the details available are pretty brief, as you can see in the following announcement message:
Hopefully more details will be made available after the cleanup, as promised in the message. The last compromise was the result of a sniffed password and a previously unknown vulnerability in the GNU/Linux kernel - I hope this time there isn't another zero-day floating around.
In the meantime the following services are disabled/unavailable:
- Debian Developers Webpages, (http://people.debian.org/~foo/)
- Debian Lintian reports.
- Planet Debian
- Debian CVS server.
- Debian Releases
- Debian Ports
- Debian Releases
More updates as they happen..
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
Your comment makes no sense.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
Well I guess it depends one what you mean by compromise.
Over the years they've:
- Lost control of hotmail.com
- Had a false verisign certifcate generated by an outsider.
- Had several websites they control defaced.
- Had source code leaks
Still they've not had any compromise of their download services that we know about.
I guess their internal systems could have been taken down by Sasser, et al, and we'd never know..
[ Parent | Reply to this comment ]
Do you know why this machine was running a 2.6 kernel? Shouldn't it be happily living in uberstableland?
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
No idea I'm afraid.
Decisions like that are really the realm of the Debian System Administrator team..
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Send Message ]
SYSADMIN TIP : sometimes I toggle between "ftp.debian.org" and "ftp.de.debian.org" in /etc/apt/sources.list to get updated DEB packages when there are Server outages.
[ Parent | Reply to this comment ]