Re: [OT]: possible spyware?

2008-06-25 Thread Michelle Konzack
Am 2008-06-23 10:25:08, schrieb H.S.: Andrei Popescu wrote: Debian also has this enabled by default. See README.Debian file for openssh-server for an explanation. Thanks for that pointer. I disallow it usually though. On one or two machines on my home network, I have allowed this for custom

Re: [OT]: possible spyware?

2008-06-25 Thread Dotan Cohen
2008/6/22 H.S. [EMAIL PROTECTED]: So looks like in Ubuntu root login via SSH is not disabled. But IIRC root account itself is disabled in Ubuntu. So this warning also is benign ... looks like. The root account in Ubuntu is not disabled. It is given a random password at install, but that

Re: [OT]: possible spyware?

2008-06-25 Thread Andrei Popescu
On Wed, Jun 25, 2008 at 03:01:02PM +0200, Dotan Cohen wrote: 2008/6/22 H.S. [EMAIL PROTECTED]: So looks like in Ubuntu root login via SSH is not disabled. But IIRC root account itself is disabled in Ubuntu. So this warning also is benign ... looks like. The root account in Ubuntu is

Re: [OT]: possible spyware?

2008-06-25 Thread Dotan Cohen
2008/6/25 Andrei Popescu [EMAIL PROTECTED]: Maybe it changed, but there used to be no password for the root account... https://help.ubuntu.com/community/RootSudo no, it hasn't changed. Nowhere does that document say that there is no password for root. what it does say is this: By default,

Re: [OT]: possible spyware?

2008-06-25 Thread Lee Glidewell
On Wednesday 25 June 2008 07:42:25 am Dotan Cohen wrote: 2008/6/25 Andrei Popescu [EMAIL PROTECTED]: Maybe it changed, but there used to be no password for the root account... https://help.ubuntu.com/community/RootSudo no, it hasn't changed. Nowhere does that document say that there

Re: [OT]: possible spyware?

2008-06-25 Thread Andrei Popescu
On Wed, Jun 25, 2008 at 04:42:25PM +0200, Dotan Cohen wrote: 2008/6/25 Andrei Popescu [EMAIL PROTECTED]: Maybe it changed, but there used to be no password for the root account... https://help.ubuntu.com/community/RootSudo no, it hasn't changed. Nowhere does that document say

Re: [OT]: possible spyware?

2008-06-25 Thread Dave Sherohman
On Wed, Jun 25, 2008 at 04:42:25PM +0200, Dotan Cohen wrote: 2008/6/25 Andrei Popescu [EMAIL PROTECTED]: Maybe it changed, but there used to be no password for the root account... https://help.ubuntu.com/community/RootSudo no, it hasn't changed. Nowhere does that document say that

Re: [OT]: possible spyware?

2008-06-25 Thread Dotan Cohen
2008/6/25 Dave Sherohman [EMAIL PROTECTED]: This is easily verified with (as root, of course) a simple `grep root /etc/shadow`: Thank you for correcting me. I thought that the password was randomly generated at install. Dotan Cohen http://what-is-what.com http://gibberish.co.il

Re: [OT]: possible spyware?

2008-06-23 Thread Andrei Popescu
On Sun, Jun 22, 2008 at 01:46:30PM -0400, H.S. wrote: Regarding the root login via SSH, the log says: -- [13:36:44] Checking if SSH root access is allowed [ Warning ] [13:36:44] Warning: The SSH and rkhunter configuration options should be the same: [13:36:44]

Re: [OT]: possible spyware?

2008-06-23 Thread H.S.
Andrei Popescu wrote: Debian also has this enabled by default. See README.Debian file for openssh-server for an explanation. Hi, Thanks for that pointer. I disallow it usually though. On one or two machines on my home network, I have allowed this for custom auto rsync based backup

[OT]: possible spyware?

2008-06-22 Thread H.S.
Hello, I was cleaning up some directories in an acquaintance's machine running Ubuntu Linux (whenever needed, I SSH to his machine from my Debian Lenny) and noticed that one of the directories had a file called ik which had this in it: - $ cat ik

Re: [OT]: possible spyware?

2008-06-22 Thread Joey Hess
H.S. wrote: Hello, I was cleaning up some directories in an acquaintance's machine running Ubuntu Linux (whenever needed, I SSH to his machine from my Debian Lenny) and noticed that one of the directories had a file called ik which had this in it:

Re: [OT]: possible spyware?

2008-06-22 Thread Ron Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 06/22/08 12:07, Joey Hess wrote: H.S. wrote: Hello, I was cleaning up some directories in an acquaintance's machine running Ubuntu Linux (whenever needed, I SSH to his machine from my Debian Lenny) and noticed that one of the directories

Re: [OT]: possible spyware?

2008-06-22 Thread H.S.
Ron Johnson wrote: But why would it be *on* a Linux box? Has he been infected with a worm or rootkit? So taking cue from your message, I ran rkhunter and got two warnings. Here they are with some context: -- Performing system configuration file checks Checking for SSH