Necessary patches

It sounds like your running the basic install of RedHat 7.2 and not applying the patches that come out. Of course you're going to get compromised. You need to take a proactive stance. Running ipchains won't help you if you're allowing access to your server on those ports for those services

Over the past year, there have been exploits for Apache, OpenSSL, BIND (DNS software), and SSH. What you have to do is apply patches so your server is not vulnerable. You either have to check RedHat'ssecurity page to see what's vulnerable or subscribe to RedHat's security mailing that warns you on vulnerable programs, both of which are available at: http://www.redhat.com/solutions/security/news/

when something new turns up, patch it. You cando it in two ways -- either install individual rpms -- or run "up2date", which is the easiest way to patch your system. The up2date command will patch everything on your system. You can get RedHat patches for free using up2date but you might want to think of getting a service agrrement from RH which costs about $60 on a yearly basis. Doing a "man up2date" will help you get started or go to www.redhat.com and search around on how to use their service.

And shut off services you don't use orneed! Use the "lsof -i" command to see what services you're running. If you're running lpd or rpc services(which have had problems in the past) turn them off.

The up2date command/service is one of the easiest ways to maintain patch-levels on a server. Monitor the security announcements and if any apply to you make sure you're patched as quickly as possible. Plus, if you're not using ssh or dns on this server, take them off. Disable access to them using ipchains and disallow them from running at start-up. Its a lot easier to block 3 ports than it is to block 5 (or whatever the #'s break down to be.)

Check your logs. This could give some information as to how the compromise occured. This will help you know where your weaknesses are. There are articles circulating the net lately on running apache as chroot which basically limits the permissions and files to which apache has access. You'd do well to invest some time researching this option as well.

One final piece of advice that will make it easier to bring the server back online would be the installation of tripwire. This will tell you what files were changed so that you can go back and either re-install the executables or look for problems in configuration files, or know that the hacker had access to the logs to clean up his tracks. It won't prevent any compromises but it should be helpful in bringing your system back up, and finding out what happened before it went down.