RE: HELP!! (fixed - not solved)
OK this is what I did. Booted up into single user mode Reset the passwords for the users Rebooted in the previously broken system Logged in as if nothing had happened. So I have cured the symptom but still don't have any clue as to what the cause was. I'll check my /var/log for any hints that I was broken into. This is a good time for me to review my security. Thanks Llama for pointing me in the right direction. And thanks everyone else for giving me input. Mark ___ Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.
Re: HELP!! (fixed - not solved)
On Saturday 09 February 2002 08:49 pm, daddy wrote: > OK this is what I did. > > Booted up into single user mode > Reset the passwords for the users > Rebooted in the previously broken system > Logged in as if nothing had happened. > > So I have cured the symptom but still don't have any clue as to what > the cause was. I'll check my /var/log for any hints that I was > broken into. This is a good time for me to review my security. > > Thanks Llama for pointing me in the right direction. And thanks > everyone else for giving me input. > When you set up passwords for each client at times the "expire in xx days" might be checked and of course then the passwords would in time expire. This then would require that you setup the clients with new (or same) passwords. Just a thought. -- Ted Ozolins (VE7TVO) Westbank, B. C. ___ Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.
Re: HELP!! (fixed - not solved)
On Sat, 9 Feb 2002 22:49:45 -0600 daddy <[EMAIL PROTECTED]> scribbled in frustration: >OK this is what I did. > >Booted up into single user mode >Reset the passwords for the users >Rebooted in the previously broken system >Logged in as if nothing had happened. > >So I have cured the symptom but still don't have any clue as to what >the cause was. I'll check my /var/log for any hints that I was >broken into. This is a good time for me to review my security. > >Thanks Llama for pointing me in the right direction. And thanks >everyone else for giving me input. You may want to check your system for a "rootdisk" folder. Mike -- "Laws for the liberal education of youth, especially for the lower classes of people, are so extremely wise and useful that to a humane and generous mind, no expense for this purpose would be thought extravagant." --John Adams ___ Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.
Re: HELP!! (fixed - not solved)
On Sun, 10 Feb 2002 08:23:49 -0500 Michael Scottaline <[EMAIL PROTECTED]> scribbled in frustration: >You may want to check your system for a "rootdisk" folder. >Mike === OOOPS! I meant "rootkit" Mike -- "Laws for the liberal education of youth, especially for the lower classes of people, are so extremely wise and useful that to a humane and generous mind, no expense for this purpose would be thought extravagant." --John Adams ___ Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.
Re: HELP!! (fixed - not solved)
On Sunday 10 February 2002 07:34, Michael wrote: > On Sun, 10 Feb 2002 08:23:49 -0500 > > Michael Scottaline <[EMAIL PROTECTED]> scribbled in frustration: > >You may want to check your system for a "rootdisk" folder. > >Mike > > === > OOOPS! I meant "rootkit" > > Mike If I have one what does that mean? Mark ___ Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.
Re: HELP!! (fixed - not solved)
On Mon, 11 Feb 2002 23:36:16 -0600 daddy <[EMAIL PROTECTED]> scribbled in frustration: >On Sunday 10 February 2002 07:34, Michael wrote: >> On Sun, 10 Feb 2002 08:23:49 -0500 >> >> Michael Scottaline <[EMAIL PROTECTED]> scribbled in frustration: >> >You may want to check your system for a "rootdisk" folder. >> >Mike >> >> === >> OOOPS! I meant "rootkit" >> >> Mike >If I have one what does that mean? === Some one has gotten control of your box and has root access. Others will hopefully correct me if I'm wrong and offer saner advice, but this may be one situation where a COMPLETE re-install *might* be required. Mike -- "Laws for the liberal education of youth, especially for the lower classes of people, are so extremely wise and useful that to a humane and generous mind, no expense for this purpose would be thought extravagant." --John Adams ___ Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.
Re: HELP!! (fixed - not solved)
Typing furiously on February 11, daddy managed to emit: > On Sunday 10 February 2002 07:34, Michael wrote: > > On Sun, 10 Feb 2002 08:23:49 -0500 > > > > Michael Scottaline <[EMAIL PROTECTED]> scribbled in frustration: > > >You may want to check your system for a "rootdisk" folder. > > >Mike > > > > === > > OOOPS! I meant "rootkit" > > > > Mike > If I have one what does that mean? That you've been hacked. Kurt -- Why do they call a fast a fast, when it goes so slow? ___ Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.
Re: HELP!! (fixed - not solved)
--- daddy <[EMAIL PROTECTED]> wrote: > On Sunday 10 February 2002 07:34, Michael wrote: > > On Sun, 10 Feb 2002 08:23:49 -0500 > > > > Michael Scottaline <[EMAIL PROTECTED]> scribbled in frustration: > > >You may want to check your system for a "rootdisk" folder. > > >Mike > > > > === > > OOOPS! I meant "rootkit" > > > > Mike > If I have one what does that mean? You've been haxored. = Lonni J. Friedman [EMAIL PROTECTED] Linux Step-by-step help: http://netllama.ipfox.com . __ Do You Yahoo!? Send FREE Valentine eCards with Yahoo! Greetings! http://greetings.yahoo.com ___ Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.