Re[2]: [expert] I've been hacked!

[Wang Jian]

Sorry, but mout, su, and umount should be suid.
A rpm -Va can find all files changed since installation.


Monday, April 24, 2000, 11:08:42 PM, you wrote:

RJ> Ron, re-read the message. It specifically says that file the shouldn't be suid
RJ> have been changed to suid since the last scan.

RJ> For instance, mount, su, and umount should never be suid. They aren't installed
RJ> that way, so "something" had to change them.

RJ> Even if it wasn't a hack job, there are many security holes here. I wouldn't want
RJ> to have that system anywhere near a public network until it's fixed.

RJ> Russ




-- 
  lark