From owner-freebsd-security  Mon Mar  5 19: 5:19 2001
Delivered-To: freebsd-security@freebsd.org
Received: from awww.jeah.net (awww.jeah.net [216.111.239.130])
	by hub.freebsd.org (Postfix) with ESMTP id 6683D37B718
	for <security@FreeBSD.ORG>; Mon,  5 Mar 2001 19:05:16 -0800 (PST)
	(envelope-from chris@jeah.net)
Received: from localhost (chris@localhost)
	by awww.jeah.net (8.11.1/8.11.0) with ESMTP id f2633nx90545;
	Mon, 5 Mar 2001 21:03:49 -0600 (CST)
	(envelope-from chris@jeah.net)
Date: Mon, 5 Mar 2001 21:03:49 -0600 (CST)
From: Chris Byrnes <chris@jeah.net>
To: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
Cc: Evren Yurtesen <yurtesen@ispro.net.tr>,
	Dag-Erling Smorgrav <des@ofug.org>, dce <dce@squish.org>,
	<security@FreeBSD.ORG>
Subject: Re: 31337 
In-Reply-To: <200103060238.f262crC01056@cwsys.cwsent.com>
Message-ID: <Pine.BSF.4.33.0103052102280.90196-100000@awww.jeah.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

> > Heh, yeah, exactly.  Sometimes people jump to conclusions too fast.
> >
> > It's just an IRCD.
>
> The problem is that you don't know whether the system has been rooted
> or not.  As such the prudent thing is to assume that the system has
> been rooted.

I suppose, however, it could easily be a user running an IRC server on a
box.

The box admin (dce) doesn't understand what an IRC server is, and why it
has opened ports.

Before doing anything drastic on a production box, I like to try to work
through possible simpler resolutions to the problem.



+ Chris Byrnes, chris@JEAH.net
 + JEAH Communications
  + 1-866-AWW-JEAH (Toll-Free)



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message