lkml.org 
[lkml]   [2003]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [OT] Rootkit queston
Samium Gromoff wrote:
> On Mon, 1 Dec 2003, Richard B. Johnson wrote:
>
>>You can check for a common 'root attack', if you have inetd,
>>by looking at the last few lines in /etc/inetd.conf.
>>It may have some access port added that allows anybody
>>who knows about it to log in as root from the network.
>>It will look something like this:
>>
>># End of inetd.conf.
>>4002 stream tcp nowait root /bin/bash --
>>

[...]

>
> How is it an attack?
> (in order to write to inetd.conf you need to be root already)

he probably meant "rootkit" instead of "root attack" and as the subject
reveals, that's what the thread was all about.

Christian.
--
BOFH excuse #13:

we're waiting for [the phone company] to fix that line
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:59    [W:0.033 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site