Guys, Let's not complicate this.
op: that looks like a line from /var/log/secure - this file only logs sessions, escalation and setuids, not ips. It is useful, in this situation, for tracing. What do /var/log/[b|w]tmp tell you? Use the last command. If this has been scrubbed then fine- these files can be scrubbed with a simple perl 2 liner, or rm'd completely. Cheers. Sent from my BlackBerry® wireless device -----Original Message----- From: Bacanu Adrian-Daniel <[email protected]> Sender: [email protected] Date: Fri, 23 Sep 2011 03:05:51 To: BH<[email protected]>; [email protected]<[email protected]> Reply-To: Bacanu Adrian-Daniel <[email protected]> Subject: Re: [Full-disclosure] sshd logins without a source _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
