I was hacked, need some help.

[Albion]

I am running

Linux 2.2.18
WU-FTPD 2.6.0 port 20 & 21
Apache 1.3.3 port 80
SSHD2 2.2.0 port 22
Sendmail 8.9.3 port 25

My firewall blocks all other ports below 1024.

I was able to find the hacker because a cron log showed a failure on a directory named "./.. /.dir". After looking a little deeper I found that the hacker had installed sshd and a sniffer. The hacker had also removed /var/log/messages, added entries to /etc/rc.d/rc.system and added an entry to /etc/inetd.conf. I found an ftp connection in /var/log/secure from a person at home.com and a stale FTP session from the same address in netstat, but the only way I can link the two is by the dates and times which were around the same time which was stamped on the programs and edits the hacker left.

Is there anything I can look at to find who this person is or where they came from?

Should I block any ports above 1024 on my firewall? If so which do I need to leave open?

Is there anything I should upgrade in the software I am running on open ports?

Please don't hammer me with flames because I am trying to learn here. A little help would be appreciated.

thanks.

-cm

 

[Albion]

Sorry, it's Apache 1.3.12

-cm

 

[hnd]

Hi Albion,
If you have the IP Adress of the Hacker and the exact times when he was there then you can go to RIPE(

http://www.ripe.net/ripencc/search.html)

There is a Database which Provider is behind this adress. Usually there is an Emailadress of the responsible Administrator. With your information and their Logfiles they can find this guy. Usually they cannot give his name to you, but most serious ISPs will check this fact and if is proof they will close that account.
But nevertheless breaking into a computer is illegal. You should think about reporting this to police (depends on the country where the Hacker and you are living)

Your second question: Close all ports which you are not using. That depends on your applications.

Last Tip: Find the security hole, close it and post it here to help other system administrators.

hnd
hasso55@yahoo.com