From owner-freebsd-questions Sat Sep 6 00:11:50 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id AAA29280 for questions-outgoing; Sat, 6 Sep 1997 00:11:50 -0700 (PDT) Received: from gdi.uoregon.edu (cisco-ts16-line4.uoregon.edu [128.223.150.204]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id AAA29273 for ; Sat, 6 Sep 1997 00:11:46 -0700 (PDT) Received: from localhost (dwhite@localhost) by gdi.uoregon.edu (8.8.5/8.8.5) with SMTP id AAA07829; Sat, 6 Sep 1997 00:11:29 -0700 (PDT) Date: Sat, 6 Sep 1997 00:11:28 -0700 (PDT) From: Doug White X-Sender: dwhite@localhost Reply-To: Doug White To: Costa Morris cc: questions@FreeBSD.ORG Subject: Re: security check output In-Reply-To: <3.0.2.32.19970904100201.00a41470@cortx.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk On Thu, 4 Sep 1997, Costa Morris wrote: > i recently received this in a security check output: > > setuid diffs: > 1,67c1,67 > < -r-sr-xr-x 1 root bin 40960 Apr 1 11:24:58 1997 /bin/chio [..] > > -r-sr-xr-x 1 root bin 40960 Apr 1 06:24:58 1997 /bin/chio For some reason all your files have timewarped hours. Did you do some sort of upgrade? You might check /var/log/messages for suspicious logins, as well as `last | less'. > can someone explain to me what happened? was my system compromised? Looks like a filetime change only. > i'm not sure if this is related or not but i am receiving messges like this: > > pid 17280 (mail), uid 1125 on /: file system full > > pid 17288 (mail), uid 1125 on /: file system full > > pid 17288 (mail), uid 1125 on /: file system full Hope these haven't been recent; you might make sure /tmp doesn't have any residual garbage laying around. > > pid 19871 (radiusd), uid 0: exited on signal 11 (core dumped) > > pid 19913 (radiusd), uid 0: exited on signal 11 (core dumped) This happens. Radius isn't a stable as it should be. Doug White | University of Oregon Internet: dwhite@resnet.uoregon.edu | Residence Networking Assistant http://gladstone.uoregon.edu/~dwhite | Computer Science Major Spam routed to /dev/null by Procmail | Death to Cyberpromo