Re: Hacked or not ?

On Sat, 12 Jun 2004 14:39:21 +0200
"Peter Rosa" <prosa@pro.sk> wrote:

PR> But what about the /var/log/messages logs absence ?
PR> And, how to test the machine, if it is healthy ?

Boot from CD and compare md5 checksums on system files. That's the first step.

Compare your kernel sources with clean ones, rebuild kernel and compare it with the running one. If you're running GENERIC, compare it with the distributed one.

Compare /modules directory with distribution one.

Check your (and system) .profile or .login etc.

After this step, you should have reasonably clean system.

-- 
Alex.
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"