Date: Tue, 06 May 1997 08:47:33 +0000 From: Pierre-Andre van Leeuwen <pvl@nanoteq.com> To: Alex Povolotsky <root@asteroid.intermedia.ru> Cc: security@FreeBSD.ORG Subject: Re: User since epoch??? Message-ID: <199705060847.IAA13502@pc-pvl.nanoteq.co.za> In-Reply-To: Your message of "Mon, 05 May 1997 22:19:30 %2B0400." <199705051819.WAA09603@asteroid.intermedia.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
> > I've just noticed WERY strange output from w: > > asteroid#/var/log/squid 202_> w > 10:18PM up 12:11, 7 users, load averages: 0.96, 1.23, 1.26 > USER TTY FROM LOGIN@ IDLE WHAT > root v1 - 1:33PM 8:43 xinit /root/.xinitrc -- /root/.xser > root p0 :0.0 5:29PM 2 irc NiteWalk irc.voicenet.com (irc- > root p1 :0.0 1:39PM 3:23 -tcsh (tcsh) > root p2 :0.0 5:38PM 1 -tcsh (tcsh) > tarkhil p3 :0.0 8:45PM 2 tin > root p4 :0.0 7:20PM - w > 5 - 01Jan70 7:48 - > > User "5" doesn't exists in /etc/passwd, nor UID 5. It doesn't have any > processes. It looks VERY much like intrusion, but I just can't understand how > can it be :-E I had more or less the same problem in X. In my case, no user other than root would show up when I run who. This happened no matter how many xterms the user had open. I did a manual reinstall of X by running the preinstall script (preinst.sh), untarring the dist and then running postinst.sh. That solved the problem for me. I recreated the problem by untarring the distribution without running the scripts, so I think that is probably what happened to you too. Maybe sysinstall stopped before running the postinst.sh script ? (I haven't had a look at the scripts though -- no time :) ) -- Pierre-Andre van Leeuwen Electronic Engineer Powered By FreeBSD ******************************** * Nanoteq (Pty) Ltd. * * Specialists in data security * * E-mail : pvl@nanoteq.com * * Ph : +27 (0)12 665-1338 * * http://www.nanoteq.co.za * ********************************
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199705060847.IAA13502>