just lots of May 7 06:03:06 dev1 -- MARK --
----- Original Message ----- From: "Hobbs, Richard" <[EMAIL PROTECTED]> To: "Ian Goodall" <[EMAIL PROTECTED]> Cc: <debian-security@lists.debian.org> Sent: Wednesday, May 07, 2003 3:27 PM Subject: Re: Have I been hacked? > Hello, > > Check /var/log/messages to see if anything happened before 14:49 on 7 May... are > you running "logcheck"?? It emails you daily reports of important goings on... > like user's crontab changes, logins, su's and other important things. it's very > very useful for spotting non-normal operations like ls. > > HTH... > > Richard. > > > Quoting Ian Goodall <[EMAIL PROTECTED]>: > > > I am running a debian woody server and when I checked the last users > > yesterday I a large number of logins in the list. On running the command > > today I get the following: > > > > dev1:/home/ian# last > > ian pts/0 172.16.3.195 Wed May 7 14:49 still logged in > > team1 pts/0 blue99.ex.ac.uk Wed May 7 13:21 - 13:57 (00:35) > > > > I have run chkrootkit but nothing was found. > > > > I have never had this before. Am I being paranoid or is someone trying to > > cover up their tracks? > > > > Thanks > > > > ijg0 > > > > > > > > -- > > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > > with a subject of "unsubscribe". Trouble? Contact > > [EMAIL PROTECTED] > > > > > > > -- > Richard Hobbs > [EMAIL PROTECTED] > http://mongeese.co.uk | http://unixforum.co.uk > > "There's only one way of life, and that's your own" - The Levellers > > _____________________________________________________ > Send all your jokes to [EMAIL PROTECTED] !! > To subscribe, email: [EMAIL PROTECTED]
