From owner-freebsd-security Fri Oct 29 3:42: 2 1999 Delivered-To: freebsd-security@freebsd.org Received: from fsfw.freesoft.hu (fsfw.freesoft.hu [195.228.127.1]) by hub.freebsd.org (Postfix) with ESMTP id 1AA8D15503 for ; Fri, 29 Oct 1999 03:41:58 -0700 (PDT) (envelope-from dbeck@freesoft.hu) Received: (from ftp@localhost) by fsfw.freesoft.hu (8.8.7/8.7.3) id MAA07502 for ; Fri, 29 Oct 1999 12:41:58 +0200 X-Authentication-Warning: fsfw.freesoft.hu: ftp set sender to using -f Received: by netfinity.freesoft.hu with Internet Mail Service (5.5.2232.9) id ; Fri, 29 Oct 1999 12:40:23 +0200 Message-Id: <1BD5A68BE9E8D211BBE8006094B9EB73E97C@netfinity.freesoft.hu> From: Beck David To: "'freebsd-security@FreeBSD.ORG'" Subject: Strange things on my computer / Help Date: Fri, 29 Oct 1999 12:40:20 +0200 Mime-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2232.9) Content-Type: text/plain; charset="iso-8859-2" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org This is the first time I write to the list, Big Hello To All, I administer a host on the Internet which basically doesn't really do anything. I installed some services like www,ftp,ssh,qmail / no big deal. I started playing with this machine 10 month ago. Since that I found a handful of strange thingies: - my wtmp files turn on each month, but after a short while allways gets corrupted - if I run who, it doesn't show any user - if I run last, it shows a big pile of garbage - I filter out ICMP totally, which is OK for me - but the kernel complains in every 10 minutes for some _out_ going ICMP packets, which goes to two hosts. I am absolutely sure that nor me nor any of my programs has nothing to do with that hosts - when I found this I started to look for the program which generates the ICMP packets but I didn't find anything - I checked the cron rules, but I didn't find anything - then I turned off the setuid bits from nearly every program on my host including ping and traceroute, but didn't help Do you guys suspect that my machine got exploited ? /I do, but I can't prove it./ Any ideas ? Thx, David. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message