>> or i should start taking backups. am i being hacked really. > > yes, really. Look at the attributes of those files: > $ lsattr /bin/ls > ------------- /bin/ls > > Modifications to the mode, size, or attributes of system binaries > like 'ls' and 'netstat' are usually good indications that you've > been hacked. > > Also, try verifying packages like 'fileutils' or 'net-tools': > rpm -V fileutils > > If you have an FTP server, and haven't patched to the latest > revision from Red Hat's errata, that was probably the point of > entry.
ok my ftp is not patched. S.5..... /bin/netstat SM5..... /sbin/ifconfig S.5..... /bin/ls S.5..... /usr/bin/dir is it enough to conclude ??? _______________________________________________ Redhat-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list
