Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: possible compromise or just misreading logs
From: Lewis Watson (listsvisionsix.com)
Date: Sun Dec 07 2003 - 11:25:38 CST
> So, my question is did I have a break-in? This machine is accessable
> as a web server through NAT and ipfw (if I configed my ipfw correctly).
> had just installed the Apache 1.3.29.
> Second, what are people using for intrusion detection? This is
> have thought about but never really thought I needed until now.
Are you sure that you did not install any of the ports around this time?
Usually you would see this type activity when a program is installed. You
should probably do a ps aux and sockstat -4 to see what is running and
There are two programs that I am familiar with to monitor changes..
chkrootkit and tripwire. Chkrootkit is trivial to install but tripwire is
a much more complete package.
I am sure there are others here that can provide much more insight to
freebsd-securityfreebsd.org mailing list
To unsubscribe, send any mail to "freebsd-security-unsubscribefreebsd.org"