At 02:06 PM 3/4/2001 -0500, you wrote:
>Let me rethink that.
>
>tty1 is your primary console, on the physical machine.
Please tell me how this relates to my concern.
>Is anyone else aware of any rootkits that point the physical tty's at
>something virtual?
What do you mean by this question?
TIA,
BenO
>On Sun, 4 Mar 2001, Ben Ocean wrote:
>
> > Hi;
> > I just received this email:
> >
> > >Date: Sun, 4 Mar 2001 09:42:56 -0800
> > >From: bin <[EMAIL PROTECTED]>
> > >To: [EMAIL PROTECTED]
> > >Subject: portmap attempt on thor from 212.205.199.91 (212.205.199.91)
> > >
> > > [212.205.199.91]
> > > Login: root Name: root
> > > Directory: /root Shell: /bin/bash
> > > On since Sun Mar 4 00:41 (EET) on tty1 20 hours 11 minutes idle
> > > (messages off)
> > > New mail received Wed Feb 28 17:18 2001 (EET)
> > > Unread since Tue Feb 13 23:55 2001 (EET)
> > > No Plan.
> >
> > I use SSH, RH6.2. Have I been hacked? How do I find out who owns that IP
> > address? If I've been hacked, what's the first thing I should do?
> > TIA,
> > BenO
> >
> >
> >
> > _______________________________________________
> > Redhat-list mailing list
> > [EMAIL PROTECTED]
> > https://listman.redhat.com/mailman/listinfo/redhat-list
> >
>
>
>
>_______________________________________________
>Redhat-list mailing list
>[EMAIL PROTECTED]
>https://listman.redhat.com/mailman/listinfo/redhat-list
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
