Re: [CentOS] Hacking Issue

2011-09-27 Thread Micky L Martin
On Mon, Sep 26, 2011 at 10:10 AM, m.r...@5-cent.us wrote: Theo Band wrote: On 09/26/2011 01:02 PM, Jennifer Botten wrote: I am having an issue with someone accessing our server via a SIP/VOIP connection. I have changed my iptables rules to drop all UDP traffic from and too this IP

[CentOS] Files being modified in /bin/

2011-09-26 Thread Micky L Martin
For the binary experts. I have a situation here. Something hideously but continuously is modifying the /bin/ executables as common as coreutils and net-tools. I can verify that from md5sum. First thing I checked was 'ls' and it has a checksum mismatch. So I removed it and reinstalled it. Then I

Re: [CentOS] Files being modified in /bin/

2011-09-26 Thread Micky L Martin
wrote: Micky L Martin wrote: Because rpm and rpmverify also seemed to have been modified so I cannot trust 'rpm -V' package verification. Already did lsof and process tracing but to no avail. Does anyone have any idea how to find that culprit? Are you sure it's not prelink that's

Re: [CentOS] Problems with Intel Ethernet and module e1000e

2011-09-26 Thread Micky L Martin
In our case, it was the driver. Google e1000e-1.6.2.tar.gz On Mon, Sep 26, 2011 at 6:56 AM, m.r...@5-cent.us wrote: Patrick Lists wrote: On 09/23/2011 12:54 PM, Volker Poplawski wrote: Hi all, I'm facing a serious problem with the e100e kernel module for Intel 82574L gigabit nics on

Re: [CentOS] Files being modified in /bin/

2011-09-26 Thread Micky L Martin
, it will be removed from my desk. It did pop like a jack in a box :P! On Mon, Sep 26, 2011 at 7:11 AM, m.r...@5-cent.us wrote: Jeremy Sanders wrote: Micky L Martin wrote: Because rpm and rpmverify also seemed to have been modified so I cannot trust 'rpm -V' package verification. Already did

Re: [CentOS] Hacking Issue

2011-09-26 Thread Micky L Martin
I would use an '-I' instead of '-A' if its a case of blocking an intruder. You can use tcpdump and 'ss -l' as well. Check out the application logs, try to see what's the intruder is up to! On Mon, Sep 26, 2011 at 7:14 AM, Keith Roberts ke...@karsites.net wrote: On Mon, 26 Sep 2011,