From owner-freebsd-security Wed Jun 26 16:11:11 1996 Return-Path: owner-security Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id QAA01578 for security-outgoing; Wed, 26 Jun 1996 16:11:11 -0700 (PDT) Received: from gatekeeper.fsl.noaa.gov (gatekeeper.fsl.noaa.gov [137.75.131.181]) by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id QAA01573 for ; Wed, 26 Jun 1996 16:11:08 -0700 (PDT) Received: from emu.fsl.noaa.gov (kelly@emu.fsl.noaa.gov [137.75.60.32]) by gatekeeper.fsl.noaa.gov (8.7.5/8.7.3) with ESMTP id XAA20975; Wed, 26 Jun 1996 23:11:03 GMT Message-Id: <199606262311.XAA20975@gatekeeper.fsl.noaa.gov> Received: by emu.fsl.noaa.gov (1.40.112.4/16.2) id AA095320693; Wed, 26 Jun 1996 17:11:33 -0600 Date: Wed, 26 Jun 1996 17:11:33 -0600 From: Sean Kelly To: troy@circle.net Cc: security@freebsd.org In-Reply-To: (message from Troy Arie Cobb on Wed, 26 Jun 1996 18:27:58 -0400 (EDT)) Subject: Re: Odd permission changes Sender: owner-security@freebsd.org X-Loop: FreeBSD.org Precedence: bulk >>>>> "Troy" == Troy Arie Cobb writes: Troy> I need to buy a clue, any help? Look through the user crontab files in /var/cron/tabs/* and look for suspect entries. If you don't find any, you might also want to check for an at job that requeues itself, so look through /var/at/jobs/*. And if you still don't find anything, look for long running processes or cyclicly executing processes that eventually do a bunch of chmods at 2 week intervals. -- Sean Kelly NOAA Forecast Systems Laboratory kelly@fsl.noaa.gov Boulder Colorado USA http://www-sdd.fsl.noaa.gov/~kelly/