Re: Weird login, possibly related to rootkit Q

["Jesper Juhl" <jesper.juhl@gmail.com>]

On 2/24/06, Gene Heskett <gene.heskett@verizon.net> wrote:
> On Friday 24 February 2006 14:04, Benjamin LaHaise wrote:
> >On Thu, Feb 23, 2006 at 01:21:07AM -0500, Gene Heskett wrote:
> >> So we did a reinstall (rh9) without formatting because there was a
> >> lot of non-replaceable data on it.  This also saved the logs, but
> >> they are obviously not a lot of help when about 5 hours is missing
> >> at about the time everything went to hell.
> >
> >Let's get this straight: your old Linux distro got rooted, so you
> > installed an old Linux distro that no longer gets security updates to
> > replace it. Why is that kernel related?  Sounds more like pebkac.
>
> The version of php in the newer distros is not backards compatible and
> breaks most of the scripts used by the web page server (this box is its
> database) and that would require a lengthy rewrite of the php stuff on
> both machines, so the re-install of rh9 was the perceived easiest way
> out.  Its a commercial business whose web page gets 20k+ hits a day &
> downtime shouldn't be extended 2-3 days while re-writeing all of that
> as it took around 2 weeks to do it all originally.  Then at the end of
> the install, we edited the yum.conf to use the legacy servers and let
> it install/upgrade everything, a Gigabyte or so.
>
> Had the php for say FC4 been backwards compatible, then obviously we
> would have taken a different path.  I don't think the yum.conf had been
> updated or installed even before this, and apt-get had, with its old
> paths in its config, also quit working quite some time back.
>

ehh, how about

1. Install newer up-to-date distro
2. install custom build old version of PHP.

still quick way to get going and you'd get the bennefit of lots of
fixes in the distro (even if your PHP would still be quite old)...

--
Jesper Juhl <jesper.juhl@gmail.com>
Don't top-post  http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please      http://www.expita.com/nomime.html