From owner-freebsd-security  Sun Jan 28 10:07:40 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id KAA24294
          for security-outgoing; Sun, 28 Jan 1996 10:07:40 -0800 (PST)
Received: from zap.io.org (zap.io.org [198.133.36.81])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id KAA24289
          for <freebsd-security@freebsd.org>; Sun, 28 Jan 1996 10:07:37 -0800 (PST)
Received: (from taob@localhost) by zap.io.org (8.6.12/8.6.12) id NAA29338; Sun, 28 Jan 1996 13:07:04 -0500
Date: Sun, 28 Jan 1996 13:07:03 -0500 (EST)
From: Brian Tao <taob@io.org>
To: FREEBSD-SECURITY-L <freebsd-security@freebsd.org>
Subject: Temporary passwd files in /etc?
Message-ID: <Pine.BSF.3.91.960128130513.29165A-100000@zap.io.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-security@freebsd.org
Precedence: bulk

    I found these two files lying around in the /etc directory of one
of our FreeBSD 2.1.0-RELEASE machines here.

-rw-r--r--  1 root  wheel      459403 Jan 20 15:35 pw.007939.orig
-rw-rw-rw-  1 root  wheel      612563 Jan 25 19:06 pw.021282~

    pw.021282~ is a world readable/writeable copy of the master.passwd
file.  How did either of those files get there?  Do the serial numbers
on them look familiar to anyone (pids?).
--
Brian Tao (BT300, taob@io.org)
Systems Administrator, Internex Online Inc.
"Though this be madness, yet there is method in't"