Date: Thu, 01 Mar 2001 16:36:32 From: "peter pajak" <peterpajak@hotmail.com> To: g_lum@yahoo.com, freebsd-questions@freebsd.org Subject: Re: Message-ID: <F125q2vXqZAmN0oG7ml00001f25@hotmail.com>
next in thread | raw e-mail | index | archive | help
yep, the second one is toor, root equivalent created by installation. you can delete it but it should serve you as a back door (just in case you loose root) also imho you should change the shell of one of the root account to /bin/sh or other in case you loose csh. p. >From: Gary Lum <g_lum@yahoo.com> >To: freebsd-questions@freebsd.org >Date: Thu, 1 Mar 2001 08:26:06 -0800 (PST) > >I am running 4.2 stable. Rebuilt Kernel enabling >Firewall. The mail to root this morning listed 2 >accounts with UID of 0 > >root >toor > >I left the machine connected overnite connected as a >gateway to my ISP so it is possible to have been >hacked already. I just wanted to check before I delete >the account. I'm a newbie to FreeBSD but have used DEC >flavors of UNIX. > >Another thing I noticed is when I used the adduser >command. I asked it to send mail to root when I >created a new user. Upon checking that mail, it was >sent from "Charlie Root" >Whol the heck is Charlie? > >Thanks >Gary Lum > > > > > >__________________________________________________ >Do You Yahoo!? >Get email at your own domain with Yahoo! Mail. >http://personal.mail.yahoo.com/ > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-questions" in the body of the message _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?F125q2vXqZAmN0oG7ml00001f25>