From: "Dmitry V. Levin" <ldv@alt-linux.org> To: ALT Linux Spring mailing list <mandrake-russian@altlinux.ru> Subject: [mdk-re] Re: [mdk-re] Нарвался на хакинг? Date: Thu May 10 13:37:00 2001 Message-ID: <20010510134534.C9738@ldv.office.alt-linux.org> (raw) In-Reply-To: <3AF926CE.9DAE2FC9@mtu-net.ru>; from okayunov@mtu-net.ru on Wed, May 09, 2001 at 03:15:26PM +0400 [-- Attachment #1: Type: text/plain, Size: 3002 bytes --] On Wed, May 09, 2001 at 03:15:26PM +0400, Oleg N. Kayunov wrote: > Ночью компьютер стоял на скачивании в dial-up > Утром прочел во внутренней почте такое сообщение: > ................................................. > Security Warning: the sha1 checksum for one of your SUID files has > changed, > maybe an intruder modified one of these suid binary in order to put in > a+backdoor... > - Checksum changed files : /usr/sbin/usernetctl > ................................................. > Сабж???? > В описании к новой версии ininscripts (я ее установил) говорилось вроде > об улучшении работы с usb, причем здесь usernetctl? Файл /usr/sbin/usernetctl входит в пакет initscripts. При пересборке последнего вполне естественно изменение исполняемых файлов. > Прочтя такое я вручную (не дожидаясь 4 часов ночи по cron) запустил > security.sh > и получил: > ................................................. > Security Warning: Change in Suid Root files found : > - Added suid root files : /usr/X11R6/bin/Xwrapper > - Removed suid root files : /usr/X11R6/bin/Xwrapper > > Security Warning: Changes in Suid Group files found : > - Added suid group files : /usr/X11R6/bin/xhextris > - Added suid group files : /usr/X11R6/bin/xlogical > - Removed suid group files : /usr/X11R6/bin/xhextris > - Removed suid group files : /usr/X11R6/bin/xlogical > > Security Warning: Change in World Writeable Files found : > - Added writables files : /tmp/.ICE-unix > - Added writables files : /tmp/.X11-unix > - Added writables files : /tmp/.X11-unix/X0 > - Removed writables files : /tmp/.ICE-unix > - Removed writables files : /tmp/.X11-unix > - Removed writables files : /tmp/.X11-unix/X0 > > Security Warning: the sha1 checksum for one of your SUID files has > changed, > maybe an intruder modified one of these suid binary in order to > put in+a backdoor... > - Checksum changed files : /usr/X11R6/bin/Xwrapper > ................................................. > Совсем что-то загадочное $:-b Добавлены и убраны..... А это похоже на ошибку в security.sh Попробуйте установить, повторяемая ли она; мне не удалось добиться подобного эффекта. > ЗЫ Я тут уже пару раз и по разному (письмом и через web) подписывался на > security - рассылку и что-то ничего не вижу. > Она еще не запустилась? security-announce - это информационная рассылка об исправленных ошибках в security. Загляните в архив. Regards, Dmitry +-------------------------------------------------------------------------+ Dmitry V. Levin mailto://ldv@alt-linux.org ALT Linux Team http://www.altlinux.ru/ Fandra Project http://www.fandra.org/ +-------------------------------------------------------------------------+ UNIX is user friendly. It's just very selective about who its friends are. [-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]
prev parent reply other threads:[~2001-05-10 13:37 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2001-05-09 15:17 Oleg N. Kayunov 2001-05-09 18:56 ` Michael Bykov 2001-05-09 19:17 ` [mdk-re] ssh Michael Bykov 2001-05-09 19:22 ` Sergey Vlasov 2001-05-09 19:52 ` Michael Bykov 2001-05-09 20:48 ` [mdk-re] Re: [mdk-re] Нарвался на хакинг? Oleg N. Kayunov 2001-05-10 13:37 ` Dmitry V. Levin [this message]
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20010510134534.C9738@ldv.office.alt-linux.org \ --to=ldv@alt-linux.org \ --cc=mandrake-russian@altlinux.ru \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
ALT Linux Community general discussions This inbox may be cloned and mirrored by anyone: git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 community community/ http://lore.altlinux.org/community \ mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com public-inbox-index community Example config snippet for mirrors. Newsgroup available over NNTP: nntp://lore.altlinux.org/org.altlinux.lists.community AGPL code for this site: git clone https://public-inbox.org/public-inbox.git