Ubuntu had to shut down five of its eight production servers last week after realising the poorly maintained systems were compromised to such an extent they had become a source of attacks against other systems.

The servers were sponsored by Canonical but hosted by the community. The systems were running an old unsupported version of Ubuntu, a factor that goes some way to explaining why they were so insecure.

Problems included missing security patches, the use of FTP (rather than a secure protocol) to access the machines, and no recent upgrades due to problems with the network cards and later kernels. Kernel upgrades were omitted because of poor backwards compatibility with the hardware Canonical supplied.

It's unclear whether or not files hosted on the servers were altered by hackers. A post-mortem by Canonical found that hacking into the systems would have been easy for any moderately skilled hacker.

"An attacker could have gotten a shell through almost any of these sites," writes (https://lists.ubuntu.com/archives/loco-contacts/2007-August/001510.html) James Troup, leader of the Canonical sysadmin team.

Ubuntu community members have been given the choice of either migrating the servers to Canonical's data centre or to stay on hosted servers. More on the incident can be found in Ubuntu's newsletter here (https://wiki.ubuntu.com/UbuntuWeeklyNewsletter/Issue52#head-b009291e4151391137b8f04a53adea995d0ee280). ®

Related stories

Root-locked Linux for the masses (14 September 2007)
http://www.theregister.co.uk/2007/09/14/linux_box/
Canonical and VMware team on mini-Ubuntu (13 September 2007)
http://www.theregister.co.uk/2007/09/13/ubuntu_jeos_vmware/
Dell UK dances with Linux (8 August 2007)
http://www.reghardware.co.uk/2007/08/08/dell_ubuntu/
Ubuntu chief mua muas Microsoft (19 June 2007)
http://www.theregister.co.uk/2007/06/19/shuttleworth_microsoft_thanks/
Dell's dance with Ubuntu: True love or farce? (2 May 2007)
http://www.theregister.co.uk/2007/05/02/dell_ubuntu_analysis/
Ubuntu launch marred by website woes (19 April 2007)
http://www.theregister.co.uk/2007/04/19/ubuntu_website_down/
Users fawn over Ubuntu's feisty Linux release (16 April 2007)
http://www.theregister.co.uk/2007/04/16/ubuntu_feisty_release/