Date: Wed, 26 Jun 1996 17:11:33 -0600 From: Sean Kelly <kelly@fsl.noaa.gov> To: troy@circle.net Cc: security@freebsd.org Subject: Re: Odd permission changes Message-ID: <199606262311.XAA20975@gatekeeper.fsl.noaa.gov> In-Reply-To: <Pine.BSF.3.91.960626181341.15893A-100000@demeter.circle.net> (message from Troy Arie Cobb on Wed, 26 Jun 1996 18:27:58 -0400 (EDT))
next in thread | previous in thread | raw e-mail | index | archive | help
>>>>> "Troy" == Troy Arie Cobb <troy@circle.net> writes:
Troy> I need to buy a clue, any help?
Look through the user crontab files in /var/cron/tabs/* and look for
suspect entries. If you don't find any, you might also want to check
for an at job that requeues itself, so look through /var/at/jobs/*.
And if you still don't find anything, look for long running processes
or cyclicly executing processes that eventually do a bunch of chmods
at 2 week intervals.
--
Sean Kelly
NOAA Forecast Systems Laboratory kelly@fsl.noaa.gov
Boulder Colorado USA http://www-sdd.fsl.noaa.gov/~kelly/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199606262311.XAA20975>