@Christopher Ahrens

that's the simplest solution you can come up with?

the vulnerabilities come from poorly written programs/scripts, if those are on your server then it is insecure if they aren't then it is secure (obviously i'm assuming nobody is stupid enough to use "password" as their root password), the only way you can reduce this problem is using the minimal software for the job and making sure to deal with user input correctly in the few scripts you do run

your convoluted method does nothing extra to help protect the server - if your solution to a server being compromised is to reset it back to the same vulnerable state it was in when it was compromised the first time then i really hope i never have to work on any systems you have "secured"

but regarding the article: it's a public army website, it's not like any secure systems were compromised, probably the only people looking at the site would be reporters looking for a bit of information (and potential recruits - but trying not to sound racist in any way, i suspect recruitment online is probably much less common in sri lanka than it is in most western nations)

@Oninoshiko

Did I say anywhere that web-site defacement was a good thing?

My point was that calling it terrorism further dilutes the word "terrorist".

There are no terrorists. Terrorism is a weapon of mass distraction.