Date: Thu, 30 Jan 1997 16:38:20 +0100 (MET) From: Robert Eckardt <roberte@mep.ruhr-uni-bochum.de> To: rewt@i-plus.net (## Troy Settle) Cc: freebsd-questions@freebsd.org Subject: Re: My security check output (fwd) Message-ID: <199701301538.QAA17837@gluon.mep.ruhr-uni-bochum.de> In-Reply-To: <Pine.BSF.3.91.970130031456.5227A-100000@radford.i-plus.net> from ## Troy Settle at "30. Jan. 97 3:15:20"
next in thread | previous in thread | raw e-mail | index | archive | help
>
> Can anyone explain this to me? I'm confused as to what the differences
> are in these files. have I been hacked? I don't see anything suspicious
> in my logs, or anywhere else. but, these suid files show up as being
> different. Am I missing something?
>
> Troy Settle <st@i-Plus.net>
>
> ---------- Forwarded message ----------
> Date: Thu, 30 Jan 1997 02:00:02 -0500 (EST)
> From: Charlie Root <root@i-plus.net>
> Subject: Radford security check output
>
> checking setuid files and devices:
> find: /home/.1/pitlord/www/sounds/built this city.mid: illegal path
> Radford setuid diffs:
> 77,80d80
~~~~~~~~
> < -r-xr-sr-x 1 bin kmem 12288 Nov 24 18:11:24 1996 /usr/sbin/slstat
> < -r-xr-sr-x 2 bin kmem 20480 Nov 24 18:11:14 1996 /usr/sbin/swapinfo
> < -r-sr-xr-x 1 root bin 20480 Nov 24 18:11:31 1996 /usr/sbin/timedc
> < -r-sr-xr-x 1 root bin 16384 Nov 24 18:11:31 1996 /usr/sbin/traceroute
> 88a89,92
~~~~~~~~
> > -r-xr-sr-x 1 bin kmem 12288 Nov 24 18:11:24 1996 /usr/sbin/slstat
[..]
You should see something before that in the diff file.
You likely have installed new programs and some of them
show up in the list of suid-programs.
Everything else is moved down the list.
(May be it would be better to sort the list by program name first.)
I don't think there is anything suspicious on your machine
(except when someone else has installed SUID-progs :-).
Robert
--
Robert Eckardt (
Ruhr-Universitaet Bochum, Inst.f.Theor.Physik, NB6/169 )
Universitaetsstrasse 150, D-44780 Bochum, Germany ----X---8----
Telefon: +49 234 700-3709, Telefax: +49 234 7094-574 8
E-Mail: RobertE@MEP.Ruhr-Uni-Bochum.de --------8----
URL: http://WWW.MEP.Ruhr-Uni-Bochum.de/~roberte
>>> To be successful one needs friends, <<<
>>> To be very successful one needs enemies. <<<
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199701301538.QAA17837>