On Thursday 07 November 2002 08:10 pm, Salane wrote: > On Thursday 07 November 2002 12:39 am, Leon Brooks wrote: > > On Thursday 07 November 2002 11:57 am, Salane wrote: > > > is this a problem with chkrootkit or with nfs > > > > Do an lsattr in (/usr)/(s)bin and check for funny attributes, just in > > case. One of the features of many rootkits is subverting tools like > > netstat. In fact, I discovered one the other day because netstat -tanp > > failed (the cracked version was too old to support -p). > > > > Cheers; Leon > > cd / > [root@sking /]# lsattr > lsattr: Inappropriate ioctl for device While reading flags on ./1 > lsattr: Inappropriate ioctl for device While reading flags on ./bin > lsattr: Inappropriate ioctl for device While reading flags on ./boot > lsattr: Inappropriate ioctl for device While reading flags on ./dev > lsattr: Inappropriate ioctl for device While reading flags on ./dhcpcd > lsattr: Inappropriate ioctl for device While reading flags on ./etc > ---------------- ./home > lsattr: Inappropriate ioctl for device While reading flags on ./initrd > lsattr: Inappropriate ioctl for device While reading flags on ./lib > lsattr: Inappropriate ioctl for device While reading flags on ./mnt > lsattr: Inappropriate ioctl for device While reading flags on ./opt > lsattr: Inappropriate ioctl for device While reading flags on ./proc > lsattr: Inappropriate ioctl for device While reading flags on ./root > lsattr: Inappropriate ioctl for device While reading flags on ./sbin > lsattr: Inappropriate ioctl for device While reading flags on ./tmp > lsattr: Inappropriate ioctl for device While reading flags on ./usr > lsattr: Inappropriate ioctl for device While reading flags on ./var
OK, so you're not using ext[23]fs except for /home? (-: Cheers; Leon
