Re: Non-existent user able to log in??? hacked????

2004-05-19 Thread Giacomo Mulas
On Tue, 18 May 2004, elijah wright wrote: > Arnaud, if i remember correctly, there's a special directory you can go to > and type 'make' - you get a set of rebuilt NIS databases as a result. Just run /usr/lib/yp/ypinit -m on the NIS master server, this ought to refresh all NIS maps. If you can,

Re: Non-existent user able to log in??? hacked????

2004-05-19 Thread Giacomo Mulas
On Tue, 18 May 2004, elijah wright wrote: > Arnaud, if i remember correctly, there's a special directory you can go to > and type 'make' - you get a set of rebuilt NIS databases as a result. Just run /usr/lib/yp/ypinit -m on the NIS master server, this ought to refresh all NIS maps. If you can,

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread Philippe Troin
elijah wright <[EMAIL PROTECTED]> writes: > > It's been a long time, but IIRC, the NIS uses it's own dbm files which > > are built from those in /etc. The test account must have existed when > > you set it up. > > Arnaud, if i remember correctly, there's a special directory you can go to > and ty

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread elijah wright
> It's been a long time, but IIRC, the NIS uses it's own dbm files which > are built from those in /etc. The test account must have existed when > you set it up. Arnaud, if i remember correctly, there's a special directory you can go to and type 'make' - you get a set of rebuilt NIS databases as

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread Steven James
Greetings, It's been a long time, but IIRC, the NIS uses it's own dbm files which are built from those in /etc. The test account must have existed when you set it up. G'day, sjames -steven james, director of research, linux labs ... .

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread A. Loonstra
Jeremy Melanson wrote: Hi Arnaud. The first things I'd check are: * Are the passwd, group, and shadow entries in your "/etc/nsswitch.conf" configured correctly? * If you have NIS installed on your machine, issue "/etc/init.d/nis stop" and "/etc/init.d/portmap stop" commands. Then see if you c

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread Philippe Troin
elijah wright <[EMAIL PROTECTED]> writes: > > It's been a long time, but IIRC, the NIS uses it's own dbm files which > > are built from those in /etc. The test account must have existed when > > you set it up. > > Arnaud, if i remember correctly, there's a special directory you can go to > and ty

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread Richard Atterer
Hi Arnaud, just some points - I have no idea whether you've been hacked. On Tue, May 18, 2004 at 10:21:22PM +0200, A. Loonstra wrote: > Last night I found the following in my wtmp: > > test ftpd19097141.222.42.5 Sat May 15 10:57 - 10:57 (00:00) > > I had this test account once but r

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread elijah wright
> It's been a long time, but IIRC, the NIS uses it's own dbm files which > are built from those in /etc. The test account must have existed when > you set it up. Arnaud, if i remember correctly, there's a special directory you can go to and type 'make' - you get a set of rebuilt NIS databases as

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread Steven James
Greetings, It's been a long time, but IIRC, the NIS uses it's own dbm files which are built from those in /etc. The test account must have existed when you set it up. G'day, sjames -steven james, director of research, linux labs ... .

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread Jeremy Melanson
Hi Arnaud. The first things I'd check are: * Are the passwd, group, and shadow entries in your "/etc/nsswitch.conf" configured correctly? * If you have NIS installed on your machine, issue "/etc/init.d/nis stop" and "/etc/init.d/portmap stop" commands. Then see if you can still log in as the 'te

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread A. Loonstra
Jeremy Melanson wrote: Hi Arnaud. The first things I'd check are: * Are the passwd, group, and shadow entries in your "/etc/nsswitch.conf" configured correctly? * If you have NIS installed on your machine, issue "/etc/init.d/nis stop" and "/etc/init.d/portmap stop" commands. Then see if you can sti

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread Richard Atterer
Hi Arnaud, just some points - I have no idea whether you've been hacked. On Tue, May 18, 2004 at 10:21:22PM +0200, A. Loonstra wrote: > Last night I found the following in my wtmp: > > test ftpd19097141.222.42.5 Sat May 15 10:57 - 10:57 (00:00) > > I had this test account once but r

Non-existent user able to log in??? hacked????

2004-05-18 Thread A. Loonstra
Hi, Last night I found the following in my wtmp: test ftpd19097141.222.42.5 Sat May 15 10:57 - 10:57 (00:00) I had this test account once but removed account rightaway. So this shouldn't show up in my logs anyhow. The weird thing is that syslog shows something else: May 15 10:5

Re: Non-existent user able to log in??? hacked????

2004-05-18 Thread Jeremy Melanson
Hi Arnaud. The first things I'd check are: * Are the passwd, group, and shadow entries in your "/etc/nsswitch.conf" configured correctly? * If you have NIS installed on your machine, issue "/etc/init.d/nis stop" and "/etc/init.d/portmap stop" commands. Then see if you can still log in as the 'te

Non-existent user able to log in??? hacked????

2004-05-18 Thread A. Loonstra
Hi, Last night I found the following in my wtmp: test ftpd19097141.222.42.5 Sat May 15 10:57 - 10:57 (00:00) I had this test account once but removed account rightaway. So this shouldn't show up in my logs anyhow. The weird thing is that syslog shows something else: May 15 10:57:41