From owner-freebsd-security  Thu Apr 19  8:41:50 2001
Delivered-To: freebsd-security@freebsd.org
Received: from aes.thinksec.com (aes.thinksec.com [193.212.248.16])
	by hub.freebsd.org (Postfix) with ESMTP id 0A39B37B422
	for <freebsd-security@FreeBSD.ORG>; Thu, 19 Apr 2001 08:41:48 -0700 (PDT)
	(envelope-from des@thinksec.com)
Received: (from des@localhost)
	by aes.thinksec.com (8.11.3/8.11.3) id f3JFfl501538;
	Thu, 19 Apr 2001 15:41:47 GMT
	(envelope-from des@thinksec.com)
X-Authentication-Warning: aes.thinksec.com: des set sender to des@thinksec.com using -f
X-URL: http://www.ofug.org/~des/
To: Raoul Schroeder <memphis_ms@gmx.net>
Cc: Kris Kennaway <kris@obsecurity.org>,
	fukuda shinichi <fukuda@alles.ad.jp>, freebsd-security@FreeBSD.ORG
Subject: Re: unknown process
References: <200104190241.AA00733@fukuda.alles.ad.jp>
	<20010418200223.A42227@xor.obsecurity.org> <3ADEFE00.812EA0A3@gmx.net>
From: Dag-Erling Smorgrav <des@thinksec.com>
Date: 19 Apr 2001 17:41:46 +0200
In-Reply-To: Raoul Schroeder's message of "Thu, 19 Apr 2001 11:02:24 -0400"
Message-ID: <xzp3db499s5.fsf@aes.thinksec.com>
Lines: 10
User-Agent: Gnus/5.0807 (Gnus v5.8.7) Emacs/20.7
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Raoul Schroeder <memphis_ms@gmx.net> writes:
> Just a quick question: How does one check for signs of intrusion. The Fre=
eBSD
> handbook does not really talk a lot about this.
> Is there a good documentation about this?

http://www.porcupine.org/

DES
--=20
Dag-Erling Sm=F8rgrav - des@thinksec.com

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message