OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
FreeBSD Security Archives: Re: Strange things on my computer /

Re: Strange things on my computer / Help

Barrett Richardson (barrettphoenix.aye.net)
Fri, 29 Oct 1999 09:08:18 -0400 (EDT)

On Fri, 29 Oct 1999, Beck David wrote:

>
> This is the first time I write to the list, Big Hello To All,
>
>
> I administer a host on the Internet which basically doesn't really
> do anything. I installed some services like www,ftp,ssh,qmail
> / no big deal.
>
> I started playing with this machine 10 month ago. Since that I found
> a handful of strange thingies:
>
> - my wtmp files turn on each month, but after a short while allways
> gets corrupted
> - if I run who, it doesn't show any user
> - if I run last, it shows a big pile of garbage
> - I filter out ICMP totally, which is OK for me
> - but the kernel complains in every 10 minutes for some _out_ going
> ICMP packets, which goes to two hosts. I am absolutely sure
> that nor me nor any of my programs has nothing to do with that hosts
> - when I found this I started to look for the program which generates
> the ICMP packets but I didn't find anything
> - I checked the cron rules, but I didn't find anything
> - then I turned off the setuid bits from nearly every program on my
> host including ping and traceroute, but didn't help
>
> Do you guys suspect that my machine got exploited ? /I do, but I can't
> prove it./
>
> Any ideas ?
>
> Thx, David.
>

Are you running a 2.x sshd binary on a 3.x system?

-

Barrett

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

This archive was generated by hypermail 2.0b3 on Fri Oct 29 1999 - 08:05:52 CDT