Yeah, I checked the /var/log and they did delete the log files. I started noticing the computer making a lot of noises, thought it was a bad fan. It got worse and worse. I didn't think anything of it. Then I couldn't get access to it via telnet, so I tried to get on locally. I had the XFree86 logon screen going, and I noticed new users that I'd never seen before, i.e. user names "dead", "a", "x", "z".
I did some prying around, and found this person that cracked my machine gave these were "root" users. Anyways, that's what happened. ----- Original Message ----- From: Matthew Dalton <[EMAIL PROTECTED]> To: Dzuy M. Nguyen <[EMAIL PROTECTED]> Cc: <debian-user@lists.debian.org> Sent: Monday, May 01, 2000 10:10 PM Subject: Re: hacked my Linux Box > "Dzuy M. Nguyen" wrote: > > > > Someone hacked into my linux web server and caused some problems. I'm still > > trying to figure it out. Anybody have a good link for linux security? > > > > I'm not sure how they got in, so any suggestions would be great. > > Check the logs in /var/log? Trouble is, if the crackers knew anything > they would have deleted the logs straight away. > > How do you know that your box was cracked? > > > -- > Unsubscribe? mail -s unsubscribe [EMAIL PROTECTED] < /dev/null > >
