On Thu, Jan 15, 2004 at 03:45:05PM +0200, Craig Schneider wrote: >Hi Guys > >Am running 2.4.22 kernel on to Debian boxes and notice today that if I >run an lsattr in >the /bin and /sbin dir some of the files are coming up with strange >attributes. > >Any ideas why ?> Or has the box more than lightly been exploited ?
depends what you mean by strange, this may come in handy: http://www.knowngoods.org/ Online hash database. It's a database of MD5 and SHA-1 hashs for standard OS files for various versions of FreeBSD, Linux, Mac OSX, and Solaris. on one of my computers (a dev box) I have -------c------ for all the sbin files on another I have s------------t for some of the files and exclusive -------------- on another. the attributes don't look evil, I'm not sure exactly how they where changed, but their md5sums check out okay. // George -- GEORGE GEORGALIS, System Admin/Architect cell: 646-331-2027 <IXOYE>< Security Services, Web, Mail, mailto:[EMAIL PROTECTED] Multimedia, DB, DNS and Metrics. http://www.galis.org/george
