From owner-freebsd-questions  Thu Mar  1  8:36:37 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from hotmail.com (f125.law11.hotmail.com [64.4.17.125])
	by hub.freebsd.org (Postfix) with ESMTP id 89B4137B71A
	for <freebsd-questions@freebsd.org>; Thu,  1 Mar 2001 08:36:32 -0800 (PST)
	(envelope-from peterpajak@hotmail.com)
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
	 Thu, 1 Mar 2001 08:36:32 -0800
Received: from 199.246.68.33 by lw11fd.law11.hotmail.msn.com with HTTP;	Thu, 01 Mar 2001 16:36:32 GMT
X-Originating-IP: [199.246.68.33]
From: "peter pajak" <peterpajak@hotmail.com>
To: g_lum@yahoo.com, freebsd-questions@freebsd.org
Subject: Re: 
Date: Thu, 01 Mar 2001 16:36:32 
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
Message-ID: <F125q2vXqZAmN0oG7ml00001f25@hotmail.com>
X-OriginalArrivalTime: 01 Mar 2001 16:36:32.0352 (UTC) FILETIME=[C601DE00:01C0A26D]
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

yep,

the second one is toor, root equivalent created by installation. you can 
delete it but it should serve you as a back door (just in case you loose 
root) also imho you should change the shell of one of the root account to 
/bin/sh or other in case you loose csh.

p.


>From: Gary Lum <g_lum@yahoo.com>
>To: freebsd-questions@freebsd.org
>Date: Thu, 1 Mar 2001 08:26:06 -0800 (PST)
>
>I am running 4.2 stable. Rebuilt Kernel enabling
>Firewall. The mail to root this morning listed 2
>accounts with UID of 0
>
>root
>toor
>
>I left the machine connected overnite connected as a
>gateway to my ISP so it is possible to have been
>hacked already. I just wanted to check before I delete
>the account. I'm a newbie to FreeBSD but have used DEC
>flavors of UNIX.
>
>Another thing I noticed is when I used the adduser
>command. I asked it to send mail to root when I
>created a new user. Upon checking that mail, it was
>sent from "Charlie Root"
>Whol the heck is Charlie?
>
>Thanks
>Gary Lum
>
>
>
>
>
>__________________________________________________
>Do You Yahoo!?
>Get email at your own domain with Yahoo! Mail.
>http://personal.mail.yahoo.com/
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-questions" in the body of the message

_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message