From owner-freebsd-security Wed May 19 21: 6:55 1999 Delivered-To: freebsd-security@freebsd.org Received: from tyr.agrknives.com (tyr.hos.net [205.238.129.41]) by hub.freebsd.org (Postfix) with ESMTP id E4B6214C83 for ; Wed, 19 May 1999 21:06:53 -0700 (PDT) (envelope-from arussell@tyr.agrknives.com) Received: (from arussell@localhost) by tyr.agrknives.com (8.8.8/8.8.8) id XAA16431 for freebsd-security@freebsd.org; Wed, 19 May 1999 23:03:26 -0500 (CDT) (envelope-from arussell) From: "Andrew G. Russell" Message-Id: <199905200403.XAA16431@tyr.agrknives.com> Subject: attack or failure To: freebsd-security@freebsd.org Date: Wed, 19 May 1999 23:03:26 -0500 (CDT) X-Mailer: ELM [version 2.4ME+ PL43 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Last night, a system that has been running FreeBSD 2.1.5 for a number of years with the last upgrade being sendmail 8.8.4 being added. Three filesystems were cleared out, I don't know if newfs or rm -rf * were used on them. the filesystems were /x(local/src/obj...) /var /tmp the of course covers up the track quite nicely. the mod times on /tmp is May 18 21:09, on /var May 18 21:09 and on /x May 18 21:33 this being an old system, when I could not get at the /x filesystem, I rebooted. This system will be upgraded to 2.2.8, but I sure would like some clue as to how it happened. Thanks in advance for any help/thoughts. A.G. Russell To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message