On Mon, 12 Jan 2004, Rohit Kumar Mehta wrote: > I noticed after an unclean shutdown (i.e. a system crash), Tripwire is > reporting that /etc/ioctl.save has been modified. > Does anyone know what this is? Is there reason for me to suspect that > my system has been hacked? >
Hi, some time ago I had exactly the same process going on on my box and asked the question here on the list. This is what I have been told: [...] Subject: Re: Changes made to /etc/ioctl.save follow Message-ID: <[EMAIL PROTECTED]> It's init (process #1). /etc/ioctl.save saves the stty(1) settings of the console. This is because originally, Linux and Unix didn't have a way to specify the console speed, parity etc at bootup which for a serial console is important. So if you boot single-user mode, at the moment you leave single-user mode the settings of the console are saved in /etc/ioctl.conf. The next time you boot and init is started, it restores the console settings from /etc/ioctl.save Now today you can set the console speed, bits and parity on the kernel command line when booting, so it's not all that important anymore. So in sysvinit-2.85 the ioctl.save code was removed. Current testing/unstable doesn't have a /etc/ioctl.save anymore. [...] Oliver -- ... don't touch the bang bang fruit -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
