Re: Have I been hacked?
just lots of
May 7 06:03:06 dev1 -- MARK --
----- Original Message -----
From: "Hobbs, Richard" <hobbs@mongeese.co.uk>
To: "Ian Goodall" <ijg@iangoodall.co.uk>
Cc: <debian-security@lists.debian.org>
Sent: Wednesday, May 07, 2003 3:27 PM
Subject: Re: Have I been hacked?
> Hello,
>
> Check /var/log/messages to see if anything happened before 14:49 on 7
May... are
> you running "logcheck"?? It emails you daily reports of important goings
on...
> like user's crontab changes, logins, su's and other important things. it's
very
> very useful for spotting non-normal operations like ls.
>
> HTH...
>
> Richard.
>
>
> Quoting Ian Goodall <ijg@iangoodall.co.uk>:
>
> > I am running a debian woody server and when I checked the last users
> > yesterday I a large number of logins in the list. On running the command
> > today I get the following:
> >
> > dev1:/home/ian# last
> > ian pts/0 172.16.3.195 Wed May 7 14:49 still logged
in
> > team1 pts/0 blue99.ex.ac.uk Wed May 7 13:21 - 13:57 (00:35)
> >
> > I have run chkrootkit but nothing was found.
> >
> > I have never had this before. Am I being paranoid or is someone trying
to
> > cover up their tracks?
> >
> > Thanks
> >
> > ijg0
> >
> >
> >
> > --
> > To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
> > with a subject of "unsubscribe". Trouble? Contact
> > listmaster@lists.debian.org
> >
> >
>
>
> --
> Richard Hobbs
> hobbs@mongeese.co.uk
> http://mongeese.co.uk | http://unixforum.co.uk
>
> "There's only one way of life, and that's your own" - The Levellers
>
> _____________________________________________________
> Send all your jokes to jokes@fishsponge.co.uk !!
> To subscribe, email: jokes-subscribe@fishsponge.co.uk
Reply to: