On Fri, Jun 03, 2005 at 08:04:17PM +1200, Andreas Hatz wrote:
> We have an interesting phenomenon occuring on one of our servers. We > have noticed that two files in the /bin directory have had their > executable permissions removed and we are unable to chmod the files as > root. Check the output of mount; is the filesystem read-only? Check lsattr for append and immutable flags. Chech getfacl, if your filesystem supports ACLs. If none of the obvious things turn up, I'd suspect a compromise. -- Re-Interpreting Historic Miracles with SED #141: %s/water/wine/g -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
