From owner-freebsd-security@FreeBSD.ORG  Tue Sep 16 08:35:59 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5749416A4B3
	for <freebsd-security@freebsd.org>;
	Tue, 16 Sep 2003 08:35:59 -0700 (PDT)
Received: from mail.speakeasy.net (mail11.speakeasy.net [216.254.0.211])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7F91743FBD
	for <freebsd-security@freebsd.org>;
	Tue, 16 Sep 2003 08:35:58 -0700 (PDT)
	(envelope-from mario@schmut.com)
Received: (qmail 11783 invoked from network); 16 Sep 2003 15:35:57 -0000
Received: from unknown (HELO schmut.com) ([66.92.49.2])
          (envelope-sender <mario@schmut.com>)
          by mail11.speakeasy.net (qmail-ldap-1.03) with SMTP
          for <niki@amk-drives.bg>; 16 Sep 2003 15:35:57 -0000
Received: from 192.168.23.2
        (SquirrelMail authenticated user mario@schmut.com)
        by webmail.schmut.com with HTTP;
        Tue, 16 Sep 2003 08:37:16 -0700 (PDT)
Message-ID: <3322.192.168.23.2.1063726636.squirrel@webmail.schmut.com>
Date: Tue, 16 Sep 2003 08:37:16 -0700 (PDT)
From: "mario" <mario@schmut.com>
To: <niki@amk-drives.bg>
In-Reply-To: <014001c37c39$956ec2f0$0d00a8c0@amkdrives.bg>
References: <014001c37c39$956ec2f0$0d00a8c0@amkdrives.bg>
X-Priority: 3
Importance: Normal
X-Mailer: SquirrelMail (version 1.2.9)
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
cc: freebsd-security@freebsd.org
Subject: Re: boot -s - can i detect intruder
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: mario@schmut.com
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 16 Sep 2003 15:35:59 -0000

maybe a hidden web cam.
i'm told there are some, that fire up triggered by motion.

mario;>

- - - - - - - -   House Of Sites   - - - - - - - -
Web Design :: Programming :: Hosting :: Maintenance

Web site: http://www.HouseOfSites.net
Email: mario@HouseOfSites.net
Tel: 415-242-3376

----------------------------------------------------
Do you schmut!?
http://www.schmut.com


> Hi list
>
> Several people have physical access to my FreeBSD box and I have the
> feeling that somebody try to get access with boot -s options . Can I log
> activity after boot -s option (change user password, install software
> and etc.). I use boot -s and change user password, but after reboot i
> can't find this atcivity in log files.
> The BSD box is shutdown and run again many time at day.
>
> Best regards,
>
> Nikolay Kanchev
>
> E-mail: niki@amk-drives.bg
>
> _______________________________________________
> freebsd-security@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to
> "freebsd-security-unsubscribe@freebsd.org"