-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thu, Jun 05, 2003 at 06:09:07AM +0100, Damir Dezeljin wrote:
> Is there any way to find out if a certain Debian Woody machine was hacked? Well, have you made any of your own patches for software on your system? Anybody else with an account? Oh, you mean cracked...start looking through /var/log/syslog* at the very least. Look for anything unusal. I recommend installing logcheck, ippl, and integrit to help keep track of activity on your system. Running chkrootkit might not be a bad idea. If you're not confident that you *weren't* cracked, format and reinstall from scratch, you can't trust the system until you do. I don't recommend restoring anything but /home from backup if you don't know what changed. hack: http://ursine.ca/jargon/html/H/hack.html crack: http://ursine.ca/jargon/html/C/crack.html - -- .''`. Baloo Ursidae <[EMAIL PROTECTED]> : :' : proud Debian admin and user `. `'` `- Debian - when you have better things to do than fix a system -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE+3wv+J5vLSqVpK2kRAkd8AKDb0/8yGuPlzHgLh82rh8dv1eXO/gCgpRyL T0prBeIHX03hYGhnLPrPtl4= =fpph -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
