Has my box been comprimised??? Slack 10.1

**Jammin1984** · 02-15-2005

Hello.

I was having a look through my /tmp when i noticed this:

Code:

jammin@Saturn&#58;/tmp$ ls -a
.          .X0-lock          gconfd-jammin  ksocket-jammin  ssh-jLErPy2580
..         .X11-unix         gconfd-root    mcop-jammin
.ICE-unix  .xfsm-ICE-YmJC95  kde-jammin     orbit-jammin
jammin@Saturn&#58;/tmp$

Its the ssh-jLErPy2580 that is worying me.

If i emacs ssh-jLErPy2580 i get this:

Code:

/tmp/ssh-jLErPy2580&#58;
  used 1 available 16022620
  drwx------   2 jammin users  80 2005-02-15 12&#58;09 .
  drwxrwxrwt  11 root   root  392 2005-02-15 15&#58;39 ..
  srwxr-xr-x   1 jammin users   0 2005-02-15 12&#58;09 agent.2580

I have no firewall as im behind a very locked down firewall on my uni network, im guessing if i cant get out, someone is going to find it hard to get in.

??????

Or am I just paranoid??

Thanks

**Krendoshazin** · 02-15-2005

check your logs, /var/log/messages , they should give you some indication as to what's going on, tmp is the only directory at the root of the file structure that can be written to by a regular user, and ssh is used for remote access, i know as i had the same problem myself, so the possibility can't be ruled out at first glance.
if in doubt you can always disable ssh, see http://www.linuxforums.org/forum/topic-33412.html for details

**adrenaline** · 02-15-2005

I think you are bit paranoid - not a bad thing.
if you really want to know open a shell

Code:

su -
<password>
cd /var/log
tail -100 messages

This will give you the last 100 lines in the messages folder if you want a continuous log then change the -100 to -f and hit ctrl -c to get back to the shell
also tail the secure folder too. You do it the exact same way.
The logs migh look different at first let me know if you need help discifering them.
Mike

**adrenaline** · 02-15-2005

Originally Posted by Krendoshazin

see http://www.linuxforums.org/forum/topic-33412.html for details

I must have missed your last post on this thread did you get it figured out or do you still need help?
Mike

**Krendoshazin** · 02-15-2005

Originally Posted by adrenaline

I must have missed your last post on this thread did you get it figured out or do you still need help?
Mike

i still need help sorting that out

**adrenaline** · 02-15-2005

Originally Posted by Krendoshazin

Originally Posted by adrenaline

I must have missed your last post on this thread did you get it figured out or do you still need help?
Mike

i still need help sorting that out

I will answer that on that other thread as to not hijack this one.

Thread Tools

Display

Has my box been comprimised??? Slack 10.1

Posting Permissions