Re: intrusion tracking

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 01/26/2011 01:06 PM, Wolfgang S. Rupprecht wrote:
> Oh, I'm sure there was an initial user-level attack that I haven't found
> yet and probably won't.

Check /etc/passwd for users you don't recognize.

grep -v nologin /etc/passwd

will give you a list of users who can log in.  The few who aren't 
regular users, such as halt and shutdown will probably have obvious 
"shells."  On my system, the only such "user" with /bin/bash is mysql. 
If one of the intruders did create a new account, it should jump out at 
you.  And, of course, if you haven't changed the root password, do it now!
-- 
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux