run the rpm verify rpm -va or something and check that your signatures are
correct.. not the be all and end all but can be a good quick check for
login replacements etc..
On Wed, 23 Jan 2002, Enda wrote:
> > I had a problem this morning with a box running SuSE 6.4. It's in a
> > company's DMZ and for some reason it was rebooted and networking did not
> > start properly. Investigation (of the remote controlled person kind, given
> > that the machine was off the air) eventually revealed that the network
> > script /etc/rc.d/init.d/network was not the correct SuSE script but rather
> > was a RedHat version.
>>suse-security-subscribe at suse.com> subscribe and post your question here, there are some dedicated security
> nuts there that answer about 50 of these type questions within minutes every
>> you'll almost certainly be referred to this as well :
>http://www.susesecurity.com/faq/>>> > This is obviously a little strange and none of those invloved in managing
> > the machine know anything about it so I'm wondering could it be part of
> > rootkit or other. It sounds a very strange to me for a rootkit to do i.e.
> > modify a script which won't be run for a long time but maybe it's a way of
> > ensuring that whatever backdoors might have been installed stay installed
> > but OTOH it does sound like a typical rootkit behaviour i.e. to assume
> > the box being cracked is running RH. Does the behaviour I described ring a
> > bell with anybody ?
> > Niall
> > --
> > Irish Linux Users' Group: ilug at linux.ie> > http://www.linux.ie/mailman/listinfo/ilug for (un)subscription
> > List maintainer: listmaster at linux.ie> >
David Airlie, Software Engineer
http://www.skynet.ie/~airlied / airlied at skynet.ie
pam_smb / Linux DecStation / Linux VAX / ILUG person
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!