Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread allan
Niccolas, I agree with John. rkhunter is your friend! I set up all my servers to run nightly with weekly updates. Peace, Allan John R Pierce wrote: > On 02/07/11 10:06 AM, Nicolas Ross wrote: >> I found some suspicious file in /bin and /usr/bin directories that are owned >> by user id 122, where t

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread JohnS
On Mon, 2011-02-07 at 15:27 -0800, Benjamin Smith wrote: > A) Determine just how far they got in (did they get access to other systems?) All the bad stuff only resided in Volatile Memory and you Erased it when you shut down the machine and forgot to copy the Memory. :-) John

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread Benjamin Smith
On Monday, February 07, 2011 10:21:18 am Nicolas Ross wrote: > mds5um has been tempered with also... It return those expected values, but > a md5sum programm I took elsewhere was returning another value... Once you've been hacked, you can't trust the core utilities (ls / md5sum/cd/etc) You can't

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread Nicolas Ross
> On 02/07/11 10:06 AM, Nicolas Ross wrote: >> I found some suspicious file in /bin and /usr/bin directories that are >> owned >> by user id 122, where this machine doesn't a userid 122. >> > > oh. get and run rkhunter. preferably do it on read only media via > another system. Ok, good tool, an

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread Tru Huynh
On Mon, Feb 07, 2011 at 01:06:56PM -0500, Nicolas Ross wrote: > Hi ! > > I think one of my machine got hacked, but I can figure out from where... > > I found some suspicious file in /bin and /usr/bin directories that are owned > by user id 122, where this machine doesn't a userid 122. > > So, d

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread cornel panceac
2011/2/7 Nicolas Ross > mds5um has been tempered with also... It return those expected values, but > a > md5sum programm I took elsewhere was returning another value... > > not all md5sum programs are the same, check several programs before deciding what's next. __

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread m . roth
John R Pierce wrote: > On 02/07/11 10:06 AM, Nicolas Ross wrote: >> So, does anyone hav a centos 3.9 install arround that can send me the >> info about (filesize, md5, modification date) these file : > > is that a 3.9 install that never got any updates afterwards? is that > x86_64 or i686?e

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread John R Pierce
On 02/07/11 10:06 AM, Nicolas Ross wrote: > I found some suspicious file in /bin and /usr/bin directories that are owned > by user id 122, where this machine doesn't a userid 122. > oh. get and run rkhunter. preferably do it on read only media via another system. _

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread John R Pierce
On 02/07/11 10:06 AM, Nicolas Ross wrote: > So, does anyone hav a centos 3.9 install arround that can send me the info > about (filesize, md5, modification date) these file : > is that a 3.9 install that never got any updates afterwards? is that x86_64 or i686?etc etc. that data is prett

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread Nicolas Ross
>> I think one of my machine got hacked, but I can figure out from where... >> >> I found some suspicious file in /bin and /usr/bin directories that are >> owned >> by user id 122, where this machine doesn't a userid 122. >> >> So, does anyone hav a centos 3.9 install arround that can send me the

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread Don Krause
On Feb 7, 2011, at 10:14 AM, m.r...@5-cent.us wrote: > Nicolas Ross wrote: >> Hi ! >> >> I think one of my machine got hacked, but I can figure out from where... >> >> I found some suspicious file in /bin and /usr/bin directories that are >> owned >> by user id 122, where this machine doesn't a

Re: [CentOS] Is there a Centos 3 around ?

2011-02-07 Thread m . roth
Nicolas Ross wrote: > Hi ! > > I think one of my machine got hacked, but I can figure out from where... > > I found some suspicious file in /bin and /usr/bin directories that are > owned > by user id 122, where this machine doesn't a userid 122. > > So, does anyone hav a centos 3.9 install arround

[CentOS] Is there a Centos 3 around ?

2011-02-07 Thread Nicolas Ross
Hi ! I think one of my machine got hacked, but I can figure out from where... I found some suspicious file in /bin and /usr/bin directories that are owned by user id 122, where this machine doesn't a userid 122. So, does anyone hav a centos 3.9 install arround that can send me the info about (