From owner-freebsd-security Fri Oct 29 4:55:46 1999 Delivered-To: freebsd-security@freebsd.org Received: from probe.webhosting.com (probe.webhosting.com [207.236.70.204]) by hub.freebsd.org (Postfix) with SMTP id ED4EC15585 for ; Fri, 29 Oct 1999 04:55:41 -0700 (PDT) (envelope-from pm@webhosting.com) Received: (qmail 87940 invoked by uid 1000); 29 Oct 1999 08:00:35 -0000 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 29 Oct 1999 08:00:35 -0000 Date: Fri, 29 Oct 1999 08:00:34 +0000 (GMT) From: Paul Mokbel X-Sender: paulm@probe.webhosting.com To: Beck David Cc: "'freebsd-security@FreeBSD.ORG'" Subject: Re: Strange things on my computer / Help In-Reply-To: <1BD5A68BE9E8D211BBE8006094B9EB73E97C@netfinity.freesoft.hu> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Get the MD5 checksums for each binary on your FreeBSD system, grab a list of the original MD5 checksums for binary files in your distribution, and then compare. I think that's the easiest way to check if someone has been messin with your system. If this is this case, then CVSup, and make world. If I am not mistaken, tripwire (/usr/ports/security/tripwire) does something similar, but it compares from a previously compiled MD5 checksum list of the files on your system at original time of program install. (I've only heard from friends that have used it). /* "Give an ape a brain and he'll swear he's the center of the universe" Paul Mokbel */ On Fri, 29 Oct 1999, Beck David wrote: > > This is the first time I write to the list, Big Hello To All, > > > I administer a host on the Internet which basically doesn't really > do anything. I installed some services like www,ftp,ssh,qmail > / no big deal. > > I started playing with this machine 10 month ago. Since that I found > a handful of strange thingies: > > - my wtmp files turn on each month, but after a short while allways > gets corrupted > - if I run who, it doesn't show any user > - if I run last, it shows a big pile of garbage > - I filter out ICMP totally, which is OK for me > - but the kernel complains in every 10 minutes for some _out_ going > ICMP packets, which goes to two hosts. I am absolutely sure > that nor me nor any of my programs has nothing to do with that hosts > - when I found this I started to look for the program which generates > the ICMP packets but I didn't find anything > - I checked the cron rules, but I didn't find anything > - then I turned off the setuid bits from nearly every program on my > host including ping and traceroute, but didn't help > > Do you guys suspect that my machine got exploited ? /I do, but I can't > prove it./ > > Any ideas ? > > Thx, David. > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message