From owner-freebsd-questions Sun May 21 15: 8:51 2000 Delivered-To: freebsd-questions@freebsd.org Received: from usc.edu (usc.edu [128.125.253.136]) by hub.freebsd.org (Postfix) with ESMTP id 508D937BA00 for ; Sun, 21 May 2000 15:08:46 -0700 (PDT) (envelope-from abdulgha@usc.edu) Received: from scf-fs.usc.edu (root@scf-fs.usc.edu [128.125.253.183]) by usc.edu (8.9.3.1/8.9.3/usc) with ESMTP id PAA08228; Sun, 21 May 2000 15:08:45 -0700 (PDT) Received: from phoenix (res-3617.usc.edu [128.125.31.111]) by scf-fs.usc.edu (8.9.3.1/8.9.3/usc) with SMTP id PAA14639; Sun, 21 May 2000 15:08:45 -0700 (PDT) Message-ID: <011801bfc371$2e5582e0$6f1f7d80@phoenix> Reply-To: "Khairuddin Abdul Ghani" From: "Khairuddin Abdul Ghani" To: Cc: References: <00b401bfc354$31b72aa0$6f1f7d80@phoenix> <20000521175026.I96573@cc942873-a.ewndsr1.nj.home.com> Subject: Re: mysterious shutdowns Date: Sun, 21 May 2000 15:09:06 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Actually, I don't have accounting running, and I've already temporarily removed the shutdown command. At the moment, only operator and kmem are part of the operator group. Although I think its somehow done remotely. ----- Original Message ----- From: "Crist J. Clark" To: "Khairuddin Abdul Ghani" Cc: Sent: Sunday, May 21, 2000 2:50 PM Subject: Re: mysterious shutdowns > You wouldn't happen to have accounting running? Then you could see > what user executed the command (and see all the commands all users > have been doing too). Do you have the default permissions on > /sbin/shutdown? > > -r-sr-x--- 1 root operator 151728 Feb 7 03:00 /sbin/shutdown > > Are any of your users in group operator? > -- > Crist J. Clark cjclark@home.com > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message