[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Have I been hacked?



Check if your program have rotated the logs...

cd /var/log

ls -l wtmp*

and, check in /etc/cron* or do a crontab -l (in user root)


E.
--
Eric LeBlanc
inouk@igt.net
--------------------------------------------------
UNIX is user friendly.
It's just selective about who its friends are.
==================================================

On Wed, 7 May 2003, Ian Goodall wrote:

> I am running a debian woody server and when I checked the last users
> yesterday I a large number of logins in the list. On running the command
> today I get the following:
>
> dev1:/home/ian# last
> ian      pts/0        172.16.3.195     Wed May  7 14:49   still logged in
> team1    pts/0        blue99.ex.ac.uk  Wed May  7 13:21 - 13:57  (00:35)
>
> I have run chkrootkit but nothing was found.
>
> I have never had this before. Am I being paranoid or is someone trying to
> cover up their tracks?
>
> Thanks
>
> ijg0
>
>
>
> --
> To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
>



Reply to: