Re: [CentOS] Hacking Issue

2011-09-27 Thread Micky L Martin
On Mon, Sep 26, 2011 at 10:10 AM, wrote: > Theo Band wrote: > > On 09/26/2011 01:02 PM, Jennifer Botten wrote: > >> > >> I am having an issue with someone accessing our server via a SIP/VOIP > >> connection. I have changed my iptables rules to drop all UDP traffic > >> from and too this IP addres

Re: [CentOS] Hacking Issue

2011-09-26 Thread Micky L Martin
I would use an '-I' instead of '-A' if its a case of blocking an intruder. You can use tcpdump and 'ss -l' as well. Check out the application logs, try to see what's the intruder is up to! On Mon, Sep 26, 2011 at 7:14 AM, Keith Roberts wrote: > On Mon, 26 Sep 2011, Jennifer Botten wrote: >

Re: [CentOS] Files being modified in /bin/

2011-09-26 Thread Micky L Martin
performance; needless to day, it will be removed from my desk. It did pop like a jack in a box :P! On Mon, Sep 26, 2011 at 7:11 AM, wrote: > Jeremy Sanders wrote: > > Micky L Martin wrote: > > > >> Because rpm and rpmverify also seemed to have been modified so I cannot

Re: [CentOS] Problems with Intel Ethernet and module e1000e

2011-09-26 Thread Micky L Martin
In our case, it was the driver. Google e1000e-1.6.2.tar.gz On Mon, Sep 26, 2011 at 6:56 AM, wrote: > Patrick Lists wrote: > > On 09/23/2011 12:54 PM, Volker Poplawski wrote: > >> Hi all, > >> > >> I'm facing a serious problem with the e100e kernel module for Intel > >> 82574L gigabit nics on Ce

Re: [CentOS] Files being modified in /bin/

2011-09-26 Thread Micky L Martin
new that prelink actually modifies the files and thought of it as a cache library or something. Literally modifies!! So, I assume the problem is solved as ls seems to have reverted back but if not then it may be an LKM kit :| On Mon, Sep 26, 2011 at 6:29 AM, Rob Kampen wrote: > Jeremy Sanders

[CentOS] Files being modified in /bin/

2011-09-26 Thread Micky L Martin
For the binary experts. I have a situation here. Something hideously but continuously is modifying the /bin/ executables as common as coreutils and net-tools. I can verify that from md5sum. First thing I checked was 'ls' and it has a checksum mismatch. So I removed it and reinstalled it. Then I mo