At 01:17 PM 3/10/2007, Dogsbody wrote:
I think something in in /home/tmp that shouldn't be there
drwxrwxrwt 12 root root 405504 Mar 9 13:17 .
I think this server is hacked!!!
Because the files beginning with ssh looks not good
The ssh- directories are standard used by ssh-agent [1], just like
anything, they still could be bad if you don't know what they
are. To be honest there is nothing in this listing that screams
hacker to me, they are all standard files used by various parts of the system.
What concerned me was the reported size 405504
du -h shows
9.0k ./.casp3000
1.0k ./ssh-bgH22636
1.0k ./mc-root
1.0k ./ssh-Dxy14397
1.0k ./ssh-TZt17792
1.0k ./ssh-MlK24086
1.0k ./.webmin
1.0k ./screens/S-root
2.0k ./screens
1.0k ./uscreens/S-admin
1.0k ./uscreens/S-tlchost
3.0k ./uscreens
430k
So what accounts for the space not listed? Something invisible?
Thom
_______________________________________________
Cobaltfacts site list
[email protected]
http://list.cobaltfacts.com/mailman/listinfo.cgi/cobaltfacts
