For those people who haven't heard, Red Hat recently suffered a security breach that allowed an attacker to get some bogus OpenSSH RPM packagessigned as valid Red Hat Enterprise Linux packages. Red Hat says thatthe packages were never added to RHN, the update system for Red HatEnterprise, but presumably the attacker has copies.

(That the package signing is separate from RHN makes sense to me, sinceI expect that Red Hat needs to sign various sorts of RPMs for testingpurposes well before they may get put into

There is an important proviso for the first principle of analyzingcompromised machines : in practice, mostattacks are not that good or that thorough. In real life, as opposed tomathematically correct security advice, there is a tradeoff between yourcaution level and the amount of work you have to do (either in analyzinga machine or in reinstalling it) and sometimes it is appropriate to takesome risk in exchange for doing less work.

The truly paranoid will reinstall machines from scratch (and never mindthe disruption) if there