nanog mailing list archives
Re: Exodus: this is bad
From: Greg Retkowski <greg () rage net>
Date: Tue, 17 Nov 1998 12:47:06 -0800 (PST)
On Tue, 17 Nov 1998, Alex P. Rudnev wrote:
And one more thing. I am not Linux specialist, but I see a resious problem because this compromised servers are usially troyaned by the 'Linux Root Kit' hidding all hacker's activity. If anyone have some tools to detect this rootkit (it include more than 200 files changed in the system), point it, please - all my attempts to contact RedHat and other Linux developers caused nothing.
Systems using RPM-based package management (Redhat and most other distributions) can use the verify function to check their system's files vs. what was installed. The command to check the entire system is 'rpm -V -a'. The output looks something like: S.5....T c /etc/exports S.5....T c /etc/hosts.allow S.5....T c /etc/motd Periods (.) mean the test passed, otherwise you'll get a fail flag.. 5: MD5 checksum S: file size L: symlink T: mtime D: device U: user G: group M: file modes A 'c' between the flags and the filename indicates that this is a configuration file (and as such commonly modified). More information should be in the rpm manpage. Hope this info helps. -- Greg <a href="mailto:greg () rage net">|\/\/| Greg Retkowski |\/\/|</a><br> <a href="http://www.rage.net/">|/\/\|"Save the Factories"|/\/\|</a><br>
Current thread:
- RE: Exodus: this is bad, (continued)
- RE: Exodus: this is bad Adam Rothschild (Nov 16)
- Re: Exodus: this is bad Jared Mauch (Nov 16)
- Re: Exodus: this is bad Richard Irving (Nov 16)
- Re: Exodus: this is bad Dalvenjah FoxFire (Nov 16)
- Re: Exodus: this is bad Edward S. Marshall (Nov 16)
- Re: Exodus: this is bad Adam Rothschild (Nov 16)
- Re: Exodus: this is bad William S. Duncanson (Nov 16)
- Re: Exodus: this is bad Michael Freeman (Nov 17)
- Re: Exodus: this is bad Alex P. Rudnev (Nov 17)
- Re: Exodus: this is bad Rob Walker (Nov 17)
- Re: Exodus: this is bad Greg Retkowski (Nov 17)
- Re: Troyans - this is bad alex (Nov 17)
- Re: Exodus: this is bad Lon R. Stockton, Jr. (Nov 17)
- Re: Exodus: this is bad Jared Mauch (Nov 16)
- RE: Exodus: this is bad Adam Rothschild (Nov 16)
- Re: Exodus: this is bad Roeland M.J. Meyer (Nov 16)
- Re: Exodus: this is bad Alex P. Rudnev (Nov 17)
- Re: Exodus: this is bad Steven J. Sobol (Nov 18)
- Re: Exodus: this is bad Jared Mauch (Nov 18)
- Re: Exodus: this is bad Michael Shields (Nov 18)
- Re: Exodus: this is bad Alex P. Rudnev (Nov 19)
- Re: Exodus: this is bad Takkala (Nov 16)