From owner-freebsd-security  Thu Apr 19  7:58:49 2001
Delivered-To: freebsd-security@freebsd.org
Received: from kottan-labs.bgsu.edu (kottan-labs.bgsu.edu [129.1.133.123])
	by hub.freebsd.org (Postfix) with ESMTP id 4551937B43C
	for <freebsd-security@FreeBSD.ORG>; Thu, 19 Apr 2001 07:58:47 -0700 (PDT)
	(envelope-from memphis_ms@gmx.net)
Received: (qmail 14009 invoked from network); 19 Apr 2001 11:00:41 -0400
Received: from m133-122.bgsu.edu (HELO gmx.net) (129.1.133.122)
  by kottan-labs.bgsu.edu with RC4-MD5 encrypted SMTP; 19 Apr 2001 11:00:41 -0400
Message-ID: <3ADEFE00.812EA0A3@gmx.net>
Date: Thu, 19 Apr 2001 11:02:24 -0400
From: Raoul Schroeder <memphis_ms@gmx.net>
X-Mailer: Mozilla 4.74 [en] (Windows NT 5.0; U)
X-Accept-Language: en
MIME-Version: 1.0
To: Kris Kennaway <kris@obsecurity.org>
Cc: fukuda shinichi <fukuda@alles.ad.jp>,
	freebsd-security@FreeBSD.ORG
Subject: Re: unknown process
References: <200104190241.AA00733@fukuda.alles.ad.jp> <20010418200223.A42227@xor.obsecurity.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

>
> Take your system off the net and check it for signs of intrusion.
>
> Kris

Just a quick question: How does one check for signs of intrusion. The FreeBSD
handbook does not really talk a lot about this.
Is there a good documentation about this?

Thank you

Raoul


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message