there are lots of things to know about security, read some security article/website

basically:
1. When installing OS, disconnect network
2. Install latest version OS/Application if possible. change default admin/root password immediately.
3. Only turn on necessary services, less services is running, less exploit will exist
4. Of course, use strong password, no telnet...
5. Check ssh log regularly, investigate suspect IP attack.
remember, when you system has been hacked, then any binary/services can be alternated, it's better reinstall from scratch.

Been hacked is a not bad experience, enjoy it...:p

The list will not end, other suggestions?

本文发表在 rolia.net 枫下论坛#!/usr/bin/perl

$mailprog = '/usr/sbin/sendmail';

@trusted = (
'xxx.yyy.zzz',
'aaa.bbb.ccc'
);

$server=`ifconfig | grep eth0 -A1|grep inet| gawk '{print \$2}'| gawk -F: '{print \$2}'`;


$date = `date +"%h %d %H:%M"`;
$buf = `who -m `;
$cur_user= `id -un`;
chomp $buf;
chomp $date;
chomp $cur_user;

@list=split(' ',$buf);
$user =$list[0];
$user_ip =$list[5];
$init_time = $list[2] . " " . $list[3] . " " . $list[4];
$user_ip =~ s/[()]//g;
foreach $tr (@trusted)
{
if ($user_ip =~ /$tr/ )
{
exit;
}
}

open(MAIL,"|$mailprog -t");

print MAIL "To: email\@hotmail.com,email\@hotmail.com\n";
print MAIL "From: email\@hotmail.com\n";
print MAIL "Subject: $user login from $user_ip on $server\n\n" ;
print MAIL "initial user: $user\n";
print MAIL "initial time: $init_time\n";
print MAIL "current user: $cur_user\n";
print MAIL "current time: $date\n";
close (MAIL);更多精彩文章及讨论，请光临枫下论坛 rolia.net