From owner-freebsd-questions Wed Mar 10 13: 4:56 1999 Delivered-To: freebsd-questions@freebsd.org Received: from cc942873-a.ewndsr1.nj.home.com (cc942873-a.ewndsr1.nj.home.com [24.2.89.207]) by hub.freebsd.org (Postfix) with ESMTP id 742DF154E6 for ; Wed, 10 Mar 1999 13:04:53 -0800 (PST) (envelope-from cjc@cc942873-a.ewndsr1.nj.home.com) Received: (from cjc@localhost) by cc942873-a.ewndsr1.nj.home.com (8.9.3/8.8.8) id QAA02073; Wed, 10 Mar 1999 16:04:24 -0500 (EST) (envelope-from cjc) From: "Crist J. Clark" Message-Id: <199903102104.QAA02073@cc942873-a.ewndsr1.nj.home.com> Subject: Re: daily security check output In-Reply-To: from Jerry Raynor at "Mar 10, 99 03:17:54 pm" To: jerryr@ComCAT.COM (Jerry Raynor) Date: Wed, 10 Mar 1999 16:04:23 -0500 (EST) Cc: flygt@sr.se, freebsd-questions@FreeBSD.ORG Reply-To: cjclark@home.com X-Mailer: ELM [version 2.4ME+ PL40 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Jerry Raynor wrote, > Does anyone know how I can find out who this is on my network that is > running this? That's easy, nobody. > > On Wed, Mar 10, 1999 at 09:09:32AM -0500, Jerry Raynor wrote: > > > Can someone tell me what signal 11 is? > > > > > > kernel log messages: > > > > pid 24815 (chat.cgi), uid 65534: exited on signal 11 ^^^^^ % grep 65534 /etc/passwd nobody:*:65534:65534:Unprivileged user:/nonexistent:/sbin/nologin Do you know what/where 'chat.cgi' is? Do you have any daemons that run as nobody (perhaps a webserver)? -- Crist J. Clark cjclark@home.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message