From owner-freebsd-security  Thu Aug 27 22:33:15 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id WAA25472
          for freebsd-security-outgoing; Thu, 27 Aug 1998 22:33:15 -0700 (PDT)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id WAA25467
          for <security@FreeBSD.ORG>; Thu, 27 Aug 1998 22:33:13 -0700 (PDT)
          (envelope-from brett@lariat.org)
Received: (from brett@localhost)
	by lariat.lariat.org (8.8.8/8.8.6) id XAA02314;
	Thu, 27 Aug 1998 23:32:07 -0600 (MDT)
Message-Id: <199808280532.XAA02314@lariat.lariat.org>
X-Sender: brett@mail.lariat.org
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1.0.49 (Beta)
Date: Thu, 27 Aug 1998 23:30:58 -0600
To: "Joe Gleason" <clash@tasam.com>, "Jan B. Koum " <jkb@best.com>
From: Brett Glass <brett@lariat.org>
Subject: Re: Shell history (Was: Re: post breakin log)
Cc: <security@FreeBSD.ORG>
In-Reply-To: <002001bdd242$f1e3baf0$f10408d1@bug.tasam.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

At 01:15 AM 8/28/98 -0400, Joe Gleason wrote:
 
>I think the best security measure would be a custom compiles who and or w
>command that logs if anyone uses it more that once per 20 seconds.  You can
>always tell if someone is up to something by their use of the who command.

That'd be me, the sysadmin. ;-)

--Brett

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message