HEllo, just yesterday I was logged to my debian machine from Sun solaris 2.5.1 machine using ssh;
when I closed session i saw message like "waiting for closing of forwarded X11 sessions from <IP>" I checked netstat on solaris - no connection from that IP; I checked netstat on debian machine and there were few connectrions opened: one to port 6000; one to finger port, one to ident port, one to portmap port and one to poppassd port; I saw also processes cfingerd, identd, portmap, poppassd and X; in X i had xearth, xterm and netscape opened; It seems someone hacked my machine; anyway i disabled all connections from that IP and killed those processes; can anyone tell me where can be the problem ? -- Matus "fantomas" Uhlar, sysadmin at NETLAB+ Kosice, Slovakia BIC coord for *.sk; admin of netlab.irc.sk; co-admin of irc.felk.cvut.cz
