On Sunday 11 February 2007 11:43, Grant wrote:
The entire contents of my /home/grant/vmware folder have suddenly
disappeared. I haven't noticed anything else strange yet. I did
configure and start shorewall for the first time yesterday instead of
using a few iptables commands from the Gentoo Home Router Guide, and
I'm running PenguinTV (a video RSS aggregator with an ebuild in
bugs.gentoo.org) and transmission (a bittorrent client in portage) for
the first time. My shorewall config is here:
http://archives.gentoo.org/gentoo-user/msg_108375.xml
What should I do next?
- Grant
Not nearly enough info for anyone to make a call on wether you got hacked. You
might bear in mind that 99% of the time, this sort of thing is the result of
an accidental 'rm'. What you should probably do next is look at your shell
history file to see if that might be the case.
If nothing turns up, check your system logs, etc. Consider this as a good
reason to run some sort of host intrusion detection system. You might even
consider writing a rudimentary HIDS yourself.
Doing the research required to do anything like a good job of it will teach
you a lot about what to look for in the future. No offense meant, but you
won't get far into a project like that before you realize that you haven't
given anyone *nearly* enough information to answer the question, "Did I get
hacked?"
Someone with the *exact* same system configuration might be able to answer
your question (most probably if they've been hacked, and can prove it) but
that's pretty unlikely. Gentoo isn't that popular (nothing against it, for
you Gentoo folk, but it really does have minor market share compared to, say,
Ubuntu, Debian, Fedora, or RH).
So you're asking a very generic question, usually immediately assignable to
operator error, about a somewhat specialized distro, with a very specific
loadout.
I wish you well, but that's going to be tough question to get a good answer
to. OTOH, maybe a few Gentoo aficionados will be pissed at my response,
research the problem within an inch of it's life, and come up with an
immediate answer, just to prove me wrong. That would fix you up nicely, and I
hope it happens. I'm just a bit doubtful.
