Hmm.  Looks like some of the FreeBSD project’s servers were compromised recently.  Having had my personal servers compromised in the past, I know it’s not a fun time for anyone involved in the usage, cleanup, and auditing of said systems.  From their post, I’d guess the developer’s home system was compromised.  Given that a leaked SSH key was the suspected method, I suspect the attacker found a useful set of keys and then followed the known_hosts breadcrumbs to find viable targets.

I find most of the intrusions on my personal, Internet-facing systems come from weak or unpatched web applications.  Since I run a shared hosting environment, a lot of this comes with the territory.  Generally, I can obviate some of the web app risks with tools like suPHP and suEXEC.  That doesn’t protect me, though, if I’ve failed to patch things like local root holes.  So like the FreeBSD folks, I try and isolate my Internet-facing systems from my backend systems.  Sadly, since most of my personal server stuff is a hobby, financial means often limit the amount of physical hardening I can do.  Nevertheless, I try and maintain at least a monthly patching cycle for all my computers.  Keeping abreast of security and application update mailing lists is also a huge plus.

Stay hardy and vigilant, folks.  Patch and secure your workstations and your servers!