RE: Have I been hacked?

["Antheunis, Jason" <Jason.Antheunis@bgminteractive.com>]

Check in /var/log and you should see a file called wtmp.1 or something
similar. The logs just get rotated.

You can view it with the -f flag to last.

last -f /var/log/wtmp.1

Jason Antheunis

-----Original Message-----
From: Ian Goodall [mailto:ijg@iangoodall.co.uk] 
Sent: Wednesday, May 07, 2003 9:52 AM
To: debian-security@lists.debian.org
Subject: Have I been hacked?

I am running a debian woody server and when I checked the last users
yesterday I a large number of logins in the list. On running the command
today I get the following:

dev1:/home/ian# last
ian      pts/0        172.16.3.195     Wed May  7 14:49   still logged
in
team1    pts/0        blue99.ex.ac.uk  Wed May  7 13:21 - 13:57  (00:35)

I have run chkrootkit but nothing was found.

I have never had this before. Am I being paranoid or is someone trying
to
cover up their tracks?

Thanks

ijg0



-- 
To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org