On Sun, Mar 03, 2002 at 08:17:58PM -0500, Michael P. Soulier wrote:
>
> Currently, a last on my firewall box shows the "date" user logged in from
> yesterday at 06:28. Now, since that's when my crons run, I suspect this box
> has not been cracked, but can someone confirm this for me?
I don't recall ever seeing an entry for user "date" in last. The
user doesn't even exist on the two boxes (one mostly potato, one
woody) I just checked.
> [EMAIL PROTECTED] msoulier]$ last
> msoulier pts/0 tigger Sun Mar 3 20:12 still logged in
> msoulier pts/0 tigger Sat Mar 2 09:29 - 12:20 (02:51)
> date { Sat Mar 2 06:28 still logged in
> date | Sat Mar 2 06:28 still logged in
date being logged in from "{" and "|" is quite worrisome as well.
The situation does not look good, IMO.
--
When we reduce our own liberties to stop terrorism, the terrorists
have already won. - reverius
Innocence is no protection when governments go bad. - Tom Swiss
