On Saturday 27 September 2003 14:33, manny wrote:
> What does one do if chkrootkit find that eth0 is in promiscuous mode? I
> can't remember the command to take it off that mode. Please help!
man ifconfig says (among other things):
[-]promisc
Enable or disable the promiscuous mode of the interface. If
selected, all packets on the network will be received by the
interface.
so, ifconfig eth0 -promisc
however. if eth0 is in promisc mode and you don't know why, and if
one of your people didn't put it in promisc mode then you are probably
rooted.
you'll want to solve that problem first.
first check if anyone put eth0 in promisc mode. or just put it in
non-promisc, change the root password, delete /etc/sudoers, and
then see if it goes into promisc again. if it does, then you've been
rooted.
if no one put it in promisc, then you're rooted.
backup your data, reinstall, download all the updates, restore your
data.
tiger
P.S. the advice above is a quick summary :). feel free to post to the
mailing list for more detail :).
--
Gerald Timothy Quimpo gquimpo*hotmail.com tiger*sni*ph
http://bopolissimus.sni.ph
Public Key: "gpg --keyserver pgp.mit.edu --recv-keys 672F4C78"
Your love life will be... interesting.
--
Philippine Linux Users' Group (PLUG) Mailing List
[EMAIL PROTECTED] (#PLUG @ irc.free.net.ph)
Official Website: http://plug.linux.org.ph
Searchable Archives: http://marc.free.net.ph
.
To leave, go to http://lists.q-linux.com/mailman/listinfo/plug
.
Are you a Linux newbie? To join the newbie list, go to
http://lists.q-linux.com/mailman/listinfo/ph-linux-newbie
