Last August, Red Hat admitted that hackers accessed infrastructure servers belonging to the company and the Fedora Project. Now after a six-month investigation, Red Hat is revealing exactly what happened.

According to internetnews.com blogger Sean Michael Kerner, the attacker was able to get hold of an SSH key that belonged to a Fedora administrator that wasn't properly secured. The intruder used the key to build modified versions of openssh and rpm. But Red Hat says good news is that

"... the investigation supports the conclusion that the modified packages were discovered before anyone accessed the system to sign any packages using the modified RPM package."

Red Hat Fedora Project Leader Paul Frields reiterates,

"... our analysis supports our initial findings that the Fedora Project infrastructure delivered no software compromised by the intruder to any of its mirrors, or the master repository from which they synchronize content. Our investigation also shows that the intrusion affected only a few internal Fedora infrastructure servers. Most of the mitigation work done by the Fedora Infrastructure team was precautionary, and allows us to have higher confidence in our present and future work."