Date: Fri, 29 Oct 1999 09:08:18 -0400 (EDT) From: Barrett Richardson <barrett@phoenix.aye.net> To: Beck David <dbeck@freesoft.hu> Cc: "'freebsd-security@FreeBSD.ORG'" <freebsd-security@FreeBSD.ORG> Subject: Re: Strange things on my computer / Help Message-ID: <Pine.BSF.4.01.9910290907070.1331-100000@phoenix.aye.net> In-Reply-To: <1BD5A68BE9E8D211BBE8006094B9EB73E97C@netfinity.freesoft.hu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 29 Oct 1999, Beck David wrote: > > This is the first time I write to the list, Big Hello To All, > > > I administer a host on the Internet which basically doesn't really > do anything. I installed some services like www,ftp,ssh,qmail > / no big deal. > > I started playing with this machine 10 month ago. Since that I found > a handful of strange thingies: > > - my wtmp files turn on each month, but after a short while allways > gets corrupted > - if I run who, it doesn't show any user > - if I run last, it shows a big pile of garbage > - I filter out ICMP totally, which is OK for me > - but the kernel complains in every 10 minutes for some _out_ going > ICMP packets, which goes to two hosts. I am absolutely sure > that nor me nor any of my programs has nothing to do with that hosts > - when I found this I started to look for the program which generates > the ICMP packets but I didn't find anything > - I checked the cron rules, but I didn't find anything > - then I turned off the setuid bits from nearly every program on my > host including ping and traceroute, but didn't help > > Do you guys suspect that my machine got exploited ? /I do, but I can't > prove it./ > > Any ideas ? > > Thx, David. > Are you running a 2.x sshd binary on a 3.x system? - Barrett To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.01.9910290907070.1331-100000>