Date: Thu, 1 Jul 2004 01:59:25 +1200 (NZST) From: Andrew McNaughton <andrew@scoop.co.nz> To: Dave <mudman@metafocus.net> Cc: freebsd-security@freebsd.org Subject: Re: ttyv for local only? Message-ID: <20040701015509.L3236@a2.scoop.co.nz> In-Reply-To: <20040629174641.N47396@metafocus.net> References: <200406282221.i5SMLMA06797@giganda.komkon.org> <20040629174641.N47396@metafocus.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 29 Jun 2004, Dave wrote: > I don't really see a problem here. My mystery logins are actually still > continuing. I'm going to see if I can code a mousetrap to find out who is > doing it. I did a fresh source compile of world from the latest cvsup for > 5.2.1 REL, and ran mergemaster to look for differing startup scripts... > > No luck yet. I wrote down the byte-sizes of sockstat, ps, and getty on a > piece of paper. I'm going to watch them over the next couple of days. md5 sums are generally better for this sort of thing. It's not all that hard to pad a file out to a desired size. Also, see /usr/ports/security/l5 for a minimalist tool which is useful for listing file data including md5 sums, file sizes, permissions, etc. Andrew -- No added Sugar. Not tested on animals. May contain traces of Nuts. If irritation occurs, discontinue use. ------------------------------------------------------------------- Andrew McNaughton Living in a shack in Tasmania andrew@scoop.co.nz Between the bush and the sea Mobile: +61 422 753 792 http://staff.scoop.co.nz/andrew/cv.doc http://www.scoop.co.nz/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040701015509.L3236>