From owner-freebsd-security@FreeBSD.ORG  Mon Dec  8 09:36:47 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2BB0116A4CE
	for <freebsd-security@freebsd.org>;
	Mon,  8 Dec 2003 09:36:47 -0800 (PST)
Received: from moutng.kundenserver.de (moutng.kundenserver.de
	[212.227.126.183])
	by mx1.FreeBSD.org (Postfix) with ESMTP id E921A43FDF
	for <freebsd-security@freebsd.org>;
	Mon,  8 Dec 2003 09:36:41 -0800 (PST)
	(envelope-from jan.muenther@nruns.com)
Received: from [212.227.126.179] (helo=mrelayng.kundenserver.de)
	by moutng.kundenserver.de with esmtp (Exim 3.35 #1)
	id 1ATPIm-00022X-00; Mon, 08 Dec 2003 18:36:08 +0100
Received: from [212.202.65.240] (helo=ergo.nruns.com)
	by mrelayng.kundenserver.de with asmtp (Exim 3.35 #1)
	id 1ATPIm-0002MS-00; Mon, 08 Dec 2003 18:36:08 +0100
Received: by ergo.nruns.com (Postfix, from userid 1001)
	id 13163CF; Mon,  8 Dec 2003 18:33:54 +0100 (CET)
Date: Mon, 8 Dec 2003 18:33:53 +0100
From: jan.muenther@nruns.com
To: Steve Francis <steve@expertcity.com>
Message-ID: <20031208173353.GA92368@ergo.nruns.com>
References: <20031207200130.C4B1216A4E0@hub.freebsd.org>
	<Pine.GSO.4.58.0312081045300.15156@mail.ilrt.bris.ac.uk>
	<20031208123501.GA87554@ergo.nruns.com>
	<20031208160428.DDF8FDAE9A@mx7.roble.com>
	<20031208164804.GA92121@ergo.nruns.com> <3FD4B58B.9020308@expertcity.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <3FD4B58B.9020308@expertcity.com>
User-Agent: Mutt/1.4i
X-Provags-ID: kundenserver.de abuse@kundenserver.de
	auth:9a8a46f2b40f7808f7699def63624ac2
cc: freebsd-security@freebsd.org
Subject: Re: possible compromise or just misreading logs
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Dec 2003 17:36:47 -0000


Thanks Steve, that's precisely the statement I wanted to make :)
Those types of integrity checkers should naturally be combined with a raised
securelevel setting.

Cheers, Jan