From owner-freebsd-security Wed Jun 26 15:28:10 1996 Return-Path: owner-security Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id PAA26437 for security-outgoing; Wed, 26 Jun 1996 15:28:10 -0700 (PDT) Received: from circle.net (demeter.circle.net [207.79.160.41]) by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id PAA26380 for ; Wed, 26 Jun 1996 15:27:59 -0700 (PDT) Received: (from troy@localhost) by circle.net (8.7.5/8.7.3) id SAA15943; Wed, 26 Jun 1996 18:27:59 -0400 (EDT) Date: Wed, 26 Jun 1996 18:27:58 -0400 (EDT) From: Troy Arie Cobb To: security@freebsd.org Subject: Odd permission changes In-Reply-To: <31C86AF7.3517@narf.castroms.moreland.k12.ca.us> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-security@freebsd.org X-Loop: FreeBSD.org Precedence: bulk I have a strange thing that's been happening regularly now, following an incident w/ a cracker-type (who is now long gone). Now, on Fridays, around 2am, all of the owner-execute permissions on all files is removed. This has happened two weeks in a row now, I have accounting active and saw the chmod, but no one was logged in, and the daily/weekly scripts don't have any chmods in them. I need to buy a clue, any help? - troy Troy Arie Cobb troy@circle.net ------------------------------------------------------ | Circle Net, Inc. | global internet access | | http://www.circle.net | for western north carolina | | info@circle.net | and beyond... | | 704-254-9500 | | ------------------------------------------------------