Date:  Thu, 30 Jul 2009 13:18:46 -0400
From:  "Darrell D. Mobley" <dmobley (at mark) uhostme.com>
Subject:  [coba-e:15854] Re: [LIKELY_SPAM]Root exploit on Blue Quartz
To:  <coba-e (at mark) bluequartz.org>
Message-Id:  <5063E23BA5284228BF129A84B0FEA7AE@HP9925NR>
In-Reply-To:  <4A71B17E.7090505 (at mark) virtbiz.com>
References:  <E776AF61EE604DC3BC41E9AB2D91AAA2 (at mark) HP9925NR> <200907300403.10254.bq (at mark) solarspeed.net> <00f101ca10c1$5b83fe70$6401a8c0 (at mark) HPPAVILION> <4A713F25.7000801 (at mark) monostar.net> <F8C0A438-9892-4429-BC33-1881AE8444E7 (at mark) scargo.nl> <662D282894D744BB94D0A6B9655C041A (at mark) HP9925NR> <4A71B17E.7090505 (at mark) virtbiz.com>
X-Mail-Count: 15854

> -----Original Message-----
> From: Chris Gebhardt - VIRTBIZ Internet [mailto:cobaltfacts (at mark) virtbiz.com]
> Sent: Thursday, July 30, 2009 10:43 AM
> To: coba-e (at mark) bluequartz.org
> Subject: [coba-e:15852] Re: [LIKELY_SPAM]Root exploit on Blue Quartz
> 
> Darrell
> I'd like to think we're pretty trustworthy in this regard!!!  ;)
> 
> I see from your ticket last night that we helped you to lock SSH to your
> IP and our internal POPs.   That's usually a better solution than just
> changing the port.   I couldn't think of a reason to recommend against
> it, but it would seem redundant at this point.
> 
> Plus, I certainly would not think of changing the SSH port as an honest
> security measure.   After all... security by obscurity is no security at
> all!

Without a doubt, Chris' crew is the best.  No trust issues there.

My concern is figuring out how these guys got my password.  Once I can close
that chapter, things will be better.

I am thinking about disabling the creation of administrator accounts in the
GUI.  I see no reason to let something so powerful be live to anyone with a
web connection.  I can re-enable it when and if I need to create such an
account.  Maybe set permissions to 000.