One that caught one server in the past month was webmin's, where one version was hacked with a backdoor would by default let an attacker run code as root, and later versions could also do so, depending on how they'd been set up. http://www.webmin.com/exploit.html It didn't help that it's easy to let webmin update itself rather than using the usual Debian apt / apt-get utilities and, if you don't use it very often, it's easy to miss an update release. What it did was install something listening to port 59000. As that port (and almost all others) has always been blocked by the firewall, it doesn't seem to have done anything bad, but it's rebuild on a fresh VPS and destroy it time. Ian, knowing that Andy has always disliked webmin... _______________________________________________ users mailing list users(a)lists.bitfolk.com https://lists.bitfolk.com/mailman/listinfo/users