Re: Odd syslog entry. Possible breakin attempt?

From: Krzysztof Halasa (khc@intrepid.pm.waw.pl)
Date: Mon Jan 24 2000 - 08:50:18 EST


"Mike A. Harris" <mharris@meteng.on.ca> writes:

> Dec 27 07:12:53 asdf in.identd[1070]: started
> Dec 27 07:13:12 asdf in.identd[1222]: started
> Dec 27 07:14:22 asdf kernel: ME-enca
> Dec 27 07:14:28 asdf kernel: 3A 30 05:49:0
> Dec 27 07:14:40 asdf kernel: 73 69 7A 65 3D 32 T size=2

Are you sure it isn't your user trying logger or syslog(3)?
That can be cured - I use srw----rw- root.users /dev/log file.

> Dec 28 01:17:21 asdf modprobe: can't locate module binfmt-00b0
> Dec 28 01:17:21 asdf modprobe: can't locate module binfmt-00b0

Some user trying to exec non-exec file?

-- 
Krzysztof Halasa
Network Administrator

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Mon Jan 31 2000 - 21:00:14 EST