Re: hacked my Linux Box

["Dzuy M. Nguyen" <linux_dzuy@hotmail.com>]

Yeah, I checked the /var/log and they did delete the log files.

I started noticing the computer making a lot of noises, thought it was
a bad fan.  It got worse and worse.  I didn't think anything of it.  Then I
couldn't get access to it via telnet, so I tried to get on locally.  I
had the XFree86 logon screen going, and I noticed new users that I'd
never seen before, i.e. user names "dead", "a", "x", "z".

I did some prying around, and found this person that cracked my machine
gave these were "root" users.  Anyways, that's what happened.

----- Original Message -----
From: Matthew Dalton <matthewd@research.canon.com.au>
To: Dzuy M. Nguyen <linux_dzuy@hotmail.com>
Cc: <debian-user@lists.debian.org>
Sent: Monday, May 01, 2000 10:10 PM
Subject: Re: hacked my Linux Box


> "Dzuy M. Nguyen" wrote:
> >
> > Someone hacked into my linux web server and caused some problems.  I'm
still
> > trying to figure it out.  Anybody have a good link for linux security?
> >
> > I'm not sure how they got in, so any suggestions would be great.
>
> Check the logs in /var/log? Trouble is, if the crackers knew anything
> they would have deleted the logs straight away.
>
> How do you know that your box was cracked?
>
>
> --
> Unsubscribe?  mail -s unsubscribe debian-user-request@lists.debian.org <
/dev/null
>
>