Securing my machine

[PsyGhost]

A couple of monthes ago I used redhat linux and my friend asked for an access via SSH. I created normal user for him, and denied a direct root login to ssh. He activated an exploit and changed my root password. My question is what do I need to do in order to protect myself from these local exploits? upgrade the kernel? the openssh package?

[Picomp314]

sounds like a good friend to me...
there seem to be quite alot of exploits like that, with an ssh session it could be a large number of things, although i would defintely try to update the openssh package

[crackers]

Originally Posted by PsyGhost

A couple of monthes ago I used redhat linux and my friend asked for an access via SSH. I created normal user for him, and denied a direct root login to ssh. He activated an exploit and changed my root password. My question is what do I need to do in order to protect myself from these local exploits? upgrade the kernel? the openssh package?

First, I would get myself a new friend after beating this one to a bloody pulp. Notice that there is no smiley here. Your so-called friend is a ... well, I don't think I can post my exact thoughts here: it'd melt my keyboard and your monitor.

Secondly, I'd chroot the person until such time as they prove themselves worthy of being able to play nice.

The only way to prevent local exploits is to not let anyone in.

[Picomp314]

word crackers
chroot jail

[PsyGhost]

I think you guys misunderstood.
He didn't destroy my system, he changed the root password just to show me he can, off course he gave me the new one, he's not that evil
How can I chroot jain him?
I'm using OpenSSH 3.6.1p2-34

well, if he's your friend, ask him what exploit he used and reporrt it to the folks at openssh.com. also, is your system up2date? there have been several updates for ssh security fixes and the kernel. if he tells you what the exploit is then you will know he is not evil. if he withhold the info, kill his account.

[armann]

Originally Posted by PsyGhost

I think you guys misunderstood.
He didn't destroy my system, he changed the root password just to show me he can, off course he gave me the new one, he's not that evil
How can I chroot jain him?
I'm using OpenSSH 3.6.1p2-34

Since he got into your system that's not the hardest thing in the world to do.
Like the others have said, great friend

Wow! you managed to dig up and post to a very dead four-year-old thread! There's only one thing for it, after closing it!

http://uk.youtube.com/watch?v=grbSQ6O6kbs

Wayne