Re: ttyv for local only?

On Tue, 29 Jun 2004, Dave wrote:

> I don't really see a problem here.  My mystery logins are actually still
> continuing.  I'm going to see if I can code a mousetrap to find out who is
> doing it.  I did a fresh source compile of world from the latest cvsup for
> 5.2.1 REL, and ran mergemaster to look for differing startup scripts...
>
> No luck yet.  I wrote down the byte-sizes of sockstat, ps, and getty on a
> piece of paper.  I'm going to watch them over the next couple of days.

md5 sums are generally better for this sort of thing.  It's not all that
hard to pad a file out to a desired size.

Also, see /usr/ports/security/l5 for a minimalist tool which is useful for
listing file data including md5 sums, file sizes, permissions, etc.

Andrew

--

No added Sugar.  Not tested on animals.  May contain traces of Nuts.  If
irritation occurs, discontinue use.

-------------------------------------------------------------------
Andrew McNaughton           Living in a shack in Tasmania
andrew@scoop.co.nz          Between the bush and the sea

Mobile: +61 422 753 792     http://staff.scoop.co.nz/andrew/cv.doc
                            http://www.scoop.co.nz/

_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"