> In output of 'w' command I saw something like that: > > --cut-- > root 7073 0.0 0.0 1240 636 ? S 11:09 0:05 > in.telnetd: some.host.in.my.domain --cut-- > > Correct address I replaced with some.host.in.my.domain. > Is root is logging to this mashine by telnet ???
Maybe, but probably not. If you had done a "px axfl" (output trimmed below) and looked at process 7073 and its children, you probably would have seen something like this: UID PID PPID PRI NI VSZ RSS TTY TIME COMMAND 0 322 1 0 0 2028 740 ? 0:02 /usr/sbin/inetd 0 9308 322 0 0 1492 712 ? 0:00 \_ in.telnetd 481 9309 9308 10 0 2248 1300 pts/6 0:00 \_ -bash in.telnetd may be run with root privs, in order to set up the login environment for the user. It does not mean that someone is telnetting in as root. By default in testing, in.telnetd runs as user "telnetd" (uid 103) rather than root. --Joe -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
