From owner-freebsd-questions@FreeBSD.ORG Wed Apr 14 09:32:13 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BE2BA16A4CE for ; Wed, 14 Apr 2004 09:32:13 -0700 (PDT) Received: from smtp.infracaninophile.co.uk (smtp.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id 254F243D46 for ; Wed, 14 Apr 2004 09:32:12 -0700 (PDT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost [IPv6:::1]) i3EGW18k033736 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 14 Apr 2004 17:32:01 +0100 (BST) (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost)id i3EGW1mR033735; Wed, 14 Apr 2004 17:32:01 +0100 (BST) (envelope-from matthew) Date: Wed, 14 Apr 2004 17:32:01 +0100 From: Matthew Seaman To: Daniela Message-ID: <20040414163201.GD33434@happy-idiot-talk.infracaninophile.co.uk> Mail-Followup-To: Matthew Seaman , Daniela , Remko Lodder , freebsd-questions@freebsd.org References: <200404140933.i3E9XdSE000461@mist.nodomain> <407D08FD.1080708@elvandar.org> <200404141608.08788.dgw@liwest.at> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="GpGaEY17fSl8rd50" Content-Disposition: inline In-Reply-To: <200404141608.08788.dgw@liwest.at> User-Agent: Mutt/1.5.6i X-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on happy-idiot-talk.infracaninophile.co.uk X-Virus-Scanned: clamd / ClamAV version devel-20040407, clamav-milter version 0.70g cc: Remko Lodder cc: freebsd-questions@freebsd.org Subject: Re: have i been hacked? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Apr 2004 16:32:13 -0000 --GpGaEY17fSl8rd50 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Apr 14, 2004 at 04:08:08PM +0000, Daniela wrote: [ size of the /bin/rcp executable ] > That needn't be the case. Mine is 932532 bytes long (and it was already t= hat=20 > size after a fresh reinstall). > And why? Debug symbols. I love to have them everywhere. > Try to strip the file, and it will be much shorter. Installed binaries should already be stripped if they're part of the base system. You have to make a special effort setting things in /etc/make.conf to prevent binaries being stripped on installation. The reason that rcp is so large on 4.x is that it's statically linked: % ls -la /bin/rcp -r-sr-xr-x 1 root wheel 251572 Feb 7 12:43 /bin/rcp* % file /bin/rcp /bin/rcp: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (Fre= eBSD), for FreeBSD 4.9, statically linked, stripped On recent 5.x, rcp will be linked against the shared libc and consequently rather smaller in size. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --GpGaEY17fSl8rd50 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFAfWeBdtESqEQa7a0RAqMMAKCJZaU45XPSGrE9nurSslgaqGwyNwCeKChn iKn9AGCOqmVbyJw5xbL/Hi4= =sp30 -----END PGP SIGNATURE----- --GpGaEY17fSl8rd50--