|
Once a rootkit has comprimised your system, theres no choice but to reinstall. You can remove the rootkit, but someone has had root access to your machine.. they could literally do anything once inside, and theres no way to know, if they're smart.
Consider virtualization or chroot jails for all your services if your running more than one on the same machine (DNS, Apache etc). Lock everything down as tight as possible (firewalls, /etc/hosts.deny, /etc/hosts.allow, SELinux if you have it etc).
Most importantly back up all those configuration files!!! Back them up! Then if you do get compromised, you can easily be back up and running again in no time.
|