Date: Fri, 29 Dec 2006 19:39:16 +0200 From: gareth <bsd@lordcow.org> To: stable@freebsd.org Subject: Re: system breach Message-ID: <20061229173916.GA3196@lordcow.org> In-Reply-To: <45954196.9040909@saeab.se> References: <20061228231226.GA16587@lordcow.org> <b91012310612282010m22a6bbdbp97bf7bdecca1530@mail.gmail.com> <20061229155845.GA1266@lordcow.org> <45954196.9040909@saeab.se>
index | next in thread | previous in thread | raw e-mail
On Fri 2006-12-29 (17:25), Thomas Nystr?m wrote: > I just checked one of my servers and also found a /tmp/download > directory with the same files that you had. > > I then compared the timestamp of /tmp/download with the timestamp > of the directories in /var/db/pkg: Same. > > My conclusion is that during a portupgrade these files were written > there, directly or indirectly by portupgrade or the port itself. oh. ok. well even though that's weird behaviour from a package it's more plausible since i haven't found anything else suspicious. are the timestamps exactly the same? i have 4 packages that're 20 minutes different. which of yours are the same? or was that for all files. (since i'd like to try an reproduce it).home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20061229173916.GA3196>