On Tue, Oct 16, 2001 at 10:17:17AM -0400, Gene Grimm wrote: > The following message was received by our admin account after > finding an intrusion (followed by rotating shell account > passwords). Can anyone tell me how to find out what devices > are referenced in this message?
You could try "ls -i /dev" and look for those inode numbers, but I'm not sure what that will tell you. > ----- Original Message ----- > > > User 501 tried to run dev 773 ino 278048 in place of dev 774 ino 310316! > > (Filename of set-id script was ./none > > > > > > , uid 501 gid 501.) > > > > Sincerely, > > perl > > > -- > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] > -- Michael Wood [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
