Re: sshd logins without a source

[james () zero-internet org uk]

Guys,

Let's not complicate this.

op: that looks like a line from /var/log/secure - this file only logs sessions, escalation and setuids, not ips. It is 
useful, in this situation, for tracing.

What do /var/log/[b|w]tmp tell you? Use the last command.

If this has been scrubbed then fine- these files can be scrubbed with a simple perl 2 liner, or rm'd completely.

Cheers.

Sent from my BlackBerry® wireless device

-----Original Message-----
From: Bacanu Adrian-Daniel <darkzatarra () yahoo com>
Sender: full-disclosure-bounces () lists grok org uk
Date: Fri, 23 Sep 2011 03:05:51 
To: BH<lists () blackhat bz>; full-disclosure () lists grok org uk<full-disclosure () lists grok org uk>
Reply-To: Bacanu Adrian-Daniel <darkzatarra () yahoo com>
Subject: Re: [Full-disclosure] sshd logins without a source

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/