Re: searching the archives (was Re: check for root kit)

2002-04-20 Thread Oliver Johns
On Saturday 20 April 2002 06:38 am, craigw wrote: %%SNIP%% > Attached is a page containing an ordinary googlet & 3 of my homemade > ones; they will search: > google > rpmfind > debian package search > debian list archive search > googlets work 2 ways: if there's an

Re: check for root kit

2002-04-20 Thread Karsten M. Self
on Thu, Apr 18, 2002, Osamu Aoki ([EMAIL PROTECTED]) wrote: > On Wed, Apr 17, 2002 at 02:31:46AM -0700, Karsten M. Self wrote: > > http://lists.debian.org/debian-devel/2002/debian-devel-200203/msg02337.html > > How do you come up with these URL? Do you have some trick to do it > quickly? I know

searching the archives (was Re: check for root kit)

2002-04-20 Thread craigw
On Fri Apr 19, 2002 at 11:47:38PM -0700, Osamu Aoki wrote: > On Fri, Apr 19, 2002 at 07:51:20AM -0500, Colin Watson wrote: > > On Thu, Apr 18, 2002 at 01:41:44AM -0700, Osamu Aoki wrote: > > > On Wed, Apr 17, 2002 at 02:31:46AM -0700, Karsten M. Self wrote: > > > > http://lists.debian.org/debian-de

Re: check for root kit

2002-04-20 Thread Osamu Aoki
On Fri, Apr 19, 2002 at 07:51:20AM -0500, Colin Watson wrote: > On Thu, Apr 18, 2002 at 01:41:44AM -0700, Osamu Aoki wrote: > > On Wed, Apr 17, 2002 at 02:31:46AM -0700, Karsten M. Self wrote: > > > http://lists.debian.org/debian-devel/2002/debian-devel-200203/msg02337.html > > > > How do you come

Re: check for root kit

2002-04-19 Thread Charles Baker
--- Paul 'Baloo' Johnson <[EMAIL PROTECTED]> wrote: > On Fri, 19 Apr 2002, Carlos Sousa wrote: > > > That's a scary tool, if I ever saw one. I have it > running once a day, > > and it almost always reports a possible LKM > "infection". Sometimes it > > detects 1 process hidden from ps, sometimes

Re: check for root kit

2002-04-19 Thread Paul 'Baloo' Johnson
On Fri, 19 Apr 2002, Carlos Sousa wrote: > That's a scary tool, if I ever saw one. I have it running once a day, > and it almost always reports a possible LKM "infection". Sometimes it > detects 1 process hidden from ps, sometimes 3 processes, sometimes none. > I'm reasonably sure the machine is n

Re: check for root kit

2002-04-19 Thread Patrick Kirk
On Fri, Apr 19, 2002 at 07:05:31PM +0100, Carlos Sousa wrote: >On Wed, 17 Apr 2002 15:02:02 +1000 >[EMAIL PROTECTED] (Tom Massey) wrote: >> ... >> $ apt-cache show chkrootkit >> ... > >That's a scary tool, if I ever saw one. I have it running once a day, >and it almost always reports a possible LKM

Re: check for root kit

2002-04-19 Thread Carlos Sousa
On Wed, 17 Apr 2002 15:02:02 +1000 [EMAIL PROTECTED] (Tom Massey) wrote: > ... > $ apt-cache show chkrootkit > ... That's a scary tool, if I ever saw one. I have it running once a day, and it almost always reports a possible LKM "infection". Sometimes it detects 1 process hidden from ps, sometimes

Re: check for root kit

2002-04-19 Thread Carlos Sousa
On Tue, 23 Apr 2002 14:31:05 + Rory Campbell-Lange <[EMAIL PROTECTED]> wrote: > ... > network. I would like to test my 3 woody machines for possible root > kits. What is the best way of doing this? Should I check the md5sum of > ... > Also, is there any way of checking for a kernel module type

Re: check for root kit

2002-04-19 Thread Colin Watson
On Thu, Apr 18, 2002 at 01:41:44AM -0700, Osamu Aoki wrote: > On Wed, Apr 17, 2002 at 02:31:46AM -0700, Karsten M. Self wrote: > > http://lists.debian.org/debian-devel/2002/debian-devel-200203/msg02337.html > > How do you come up with these URL? Do you have some trick to do it > quickly? I know

Re: check for root kit

2002-04-18 Thread Osamu Aoki
On Wed, Apr 17, 2002 at 02:31:46AM -0700, Karsten M. Self wrote: > http://lists.debian.org/debian-devel/2002/debian-devel-200203/msg02337.html How do you come up with these URL? Do you have some trick to do it quickly? I know messages are stored at l.d.o site but ... Wondering... Osamu -- ~\^

Re: check for root kit

2002-04-17 Thread Karsten M. Self
on Wed, Apr 17, 2002, Tom Massey ([EMAIL PROTECTED]) wrote: > On Tue, Apr 23, 2002 at 02:31:05PM +, Rory Campbell-Lange wrote: > > There is a very small possibility that someone has intruded into our > > network. I would like to test my 3 woody machines for possible root > > kits. What is the b

Re: check for root kit

2002-04-17 Thread ben
On Tuesday 23 April 2002 07:31 am, Rory Campbell-Lange wrote: > There is a very small possibility that someone has intruded into our > network. I would like to test my 3 woody machines for possible root > kits. What is the best way of doing this? Should I check the md5sum of > programs such as find

Re: check for root kit

2002-04-17 Thread Tom Massey
On Tue, Apr 23, 2002 at 02:31:05PM +, Rory Campbell-Lange wrote: > There is a very small possibility that someone has intruded into our > network. I would like to test my 3 woody machines for possible root > kits. What is the best way of doing this? Should I check the md5sum of > programs such

Re: check for root kit

2002-04-17 Thread Crispin Wellington
On Tue, 2002-04-23 at 22:31, Rory Campbell-Lange wrote: > There is a very small possibility that someone has intruded into our > network. I would like to test my 3 woody machines for possible root > kits. What is the best way of doing this? Should I check the md5sum of > programs such as find, ps a

check for root kit

2002-04-16 Thread Rory Campbell-Lange
There is a very small possibility that someone has intruded into our network. I would like to test my 3 woody machines for possible root kits. What is the best way of doing this? Should I check the md5sum of programs such as find, ps and ifconfig against the packaged versions? Also, is there any w