Re: Have I been hacked?

[Sylvain Soliman <Sylvain.Soliman@m4x.org>]

> I am running a debian woody server and when I checked the last users
> yesterday I a large number of logins in the list. On running the command
> today I get the following:
> 
> dev1:/home/ian# last
> ian      pts/0        172.16.3.195     Wed May  7 14:49   still logged in
> team1    pts/0        blue99.ex.ac.uk  Wed May  7 13:21 - 13:57  (00:35)
> 
> I have run chkrootkit but nothing was found.
> 
> I have never had this before. Am I being paranoid or is someone trying to
> cover up their tracks?

  logrotate?

        Sylvain.

-- 
Sylvain Soliman <Sylvain.Soliman@m4x.org>        GnuPG Public Key: 0x0F53AF99
Secretaire adjoint - Fede. Francaise de Go  http://ffg.jeudego.org/ffg-f.html
Co-mainteneur de PilotGOne    http://minas.ithil.org/pilotgone/pilotgone.html
Page personelle                          http://contraintes.inria.fr/~soliman