Yes. I made the mistake of providing accounts for friends, and one of them had a common account name and an easily guessable password - it was bruteforced, the

Yes. I made the mistake of providing accounts for friends, and one of them had a common account name and an easily guessable password - it was bruteforced, the server rootkitted, and used as a 0-day ftp drop. I only noticed when bandwidth usage went through the roof. I didn't trust the server at all after that, of course, so nuked it and reinstalled from scratch. Sans my idiot friend's account. Luckily it was a standalone and not part of the network or i would have had a lot more work to do; once something gets inside you just can't trust anything. Needless to say I would never have been giving away accounts on a big, fast, well connected work machine to friends though .. coughs .. anyway. Was a good lesson about not trusting others to know what they're doing, taking steps to minimise bruteforcing (different port, limited tries) and rootkit detection, which is pretty hard. In fact it can be almost impossible to even know you've been rootkitted if you do not take proper precautions in advance. I only knew because they'd blown their cover with the bandwidth; that was a bit of a wakeup call. Nothing like having one of your boxes subverted before your eyes and you don't even notice .. that was a nice feeling, not. Still, glad it happened. Getting hacked is like catching chickenpox; good to happen nice and early (but not too early), builds resistance for later on. Haven't been hacked since.