Re: Have I been hacked?
Hello,
Check /var/log/messages to see if anything happened before 14:49 on 7 May... are
you running "logcheck"?? It emails you daily reports of important goings on...
like user's crontab changes, logins, su's and other important things. it's very
very useful for spotting non-normal operations like ls.
HTH...
Richard.
Quoting Ian Goodall <ijg@iangoodall.co.uk>:
> I am running a debian woody server and when I checked the last users
> yesterday I a large number of logins in the list. On running the command
> today I get the following:
>
> dev1:/home/ian# last
> ian pts/0 172.16.3.195 Wed May 7 14:49 still logged in
> team1 pts/0 blue99.ex.ac.uk Wed May 7 13:21 - 13:57 (00:35)
>
> I have run chkrootkit but nothing was found.
>
> I have never had this before. Am I being paranoid or is someone trying to
> cover up their tracks?
>
> Thanks
>
> ijg0
>
>
>
> --
> To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact
> listmaster@lists.debian.org
>
>
--
Richard Hobbs
hobbs@mongeese.co.uk
http://mongeese.co.uk | http://unixforum.co.uk
"There's only one way of life, and that's your own" - The Levellers
_____________________________________________________
Send all your jokes to jokes@fishsponge.co.uk !!
To subscribe, email: jokes-subscribe@fishsponge.co.uk
Reply to: