Re: [OT] Rootkit queston

[Christian]

Samium Gromoff wrote:
> On Mon, 1 Dec 2003, Richard B. Johnson wrote:
>
> > You can check for a common 'root attack', if you have inetd,
> > by looking at the last few lines in /etc/inetd.conf.
> > It may have some access port added that allows anybody
> > who knows about it to log in as root from the network.
> > It will look something like this:
> >
> > # End of inetd.conf.
> > 4002 stream tcp nowait root /bin/bash --

[...]

> How is it an attack?
> 	(in order to write to inetd.conf you need to be root already)

he probably meant "rootkit" instead of "root attack" and as the subject 
reveals, that's what the thread was all about.

Christian.
--
BOFH excuse #13:

we're waiting for [the phone company] to fix that line
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/