From owner-freebsd-questions  Fri May  4  7: 8:39 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from awww.jeah.net (awww.jeah.net [216.111.239.130])
	by hub.freebsd.org (Postfix) with ESMTP id 303A337B423
	for <freebsd-questions@FreeBSD.ORG>; Fri,  4 May 2001 07:08:36 -0700 (PDT)
	(envelope-from jslivko@jeah.net)
Received: from localhost (jslivko@localhost)
	by awww.jeah.net (8.11.3/8.11.0) with ESMTP id f44E7uv96603;
	Fri, 4 May 2001 09:07:56 -0500 (CDT)
	(envelope-from jslivko@jeah.net)
Date: Fri, 4 May 2001 09:07:56 -0500 (CDT)
From: "Jonathan M. Slivko" <jslivko@jeah.net>
To: "Kasper (swebase)" <kasper@swebase.com>
Cc: <freebsd-questions@FreeBSD.ORG>
Subject: Re: Server hangs.
In-Reply-To: <000f01c0d4a1$ef685830$642750d5@swebasekasper>
Message-ID: <20010504090619.Q96554-100000@awww.jeah.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=X-UNKNOWN
Content-Transfer-Encoding: QUOTED-PRINTABLE
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Do you have any kind of CGI's running on this machine for a webserver,
etc? What that appears to be is a message that's telling you that
something is trying to access a file called /etc/spwd.db by either a
program or a username by the name of cgiwrap. I would, just to be on the
safe side, sniff around the machine a little bit, see if anything else
peculiar shows up. If so, then you may have a hacked box on your hands.

-- Jonathan M. Slivko

-----------------------------------------------------------
Jonathan M. Slivko         | e-mail: jslivko@jeah.net
Sys. Admin, DataSyrgeINET  | http://www.datasyrge.net
Tech. Support, SimpHost    | http://www.simphost.com
IRC Oper, AsylumNet IRC    | http://www.asylum-net.org
----------------------------------------------------------
               FreeBSD -- The Power to Serve!
                    http://www.freebsd.org

On Fri, 4 May 2001, Kasper (swebase) wrote:

> Suddenly the server hangs and must be restarted with the powerswitch.
>
> Iget this message before it dies.
>
> Message from syslogd@devil at Fri May  4 15:52:04 2001 ...
> devil May  4 15:52:04cgiwrap: /etc/spwd.db
>
> Whats wrong?
>
>
> Med v=E4nlig h=E4lsning
> Swebase AB
> Kasper Kristiansson
> 042-162000, Fax 042-162009
> Mobil 070-8995989
>
> Swebase AB.
> http://www.swebase.com
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message