From owner-freebsd-security Fri Nov 1 5:53:35 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F027E37B404 for ; Fri, 1 Nov 2002 05:53:32 -0800 (PST) Received: from smtp.melim.com.br (aririba.melim.com.br [200.215.110.25]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9A34443E8A for ; Fri, 1 Nov 2002 05:53:31 -0800 (PST) (envelope-from ronan@melim.com.br) Received: from fazendinha (ressacada.melim.com.br [200.215.110.4]) by smtp.melim.com.br (Postfix) with SMTP id 8116EFDA0 for ; Fri, 1 Nov 2002 10:52:05 -0300 (EST) Message-ID: <00e901c281a6$7a7dbc50$34a8a8c0@melim.com.br> From: "Ronan Lucio" To: Subject: Something weird Date: Fri, 1 Nov 2002 09:59:13 -0300 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hello, Today, when I logged in my server, last command showed only one connection (the last). So, I took a look at "netstat -a" and I havenīt found any connection from a strange IP on a different port. I also took a look at "ps -ax" and I didnīt found any strange process running, too. After that, Iīve saw that the file /root/.history is dated old (itīs correct because I use another account with bash shell). There is possibility that it be an attack/invasion? Thankīs, Ronan To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message