Re: last command - strange entries?

From: Saurabh Bhasin (sbhasin_at_gmail.com)
Date: 06/16/05

  • Next message: Richard Coleman: "Re: TCP timestamp vulnerability"
    Date: Thu, 16 Jun 2005 08:35:34 -0700
    To: Neo-Vortex <root@neo-vortex.net>
    
    

    > The last command uses /var/log/wtmp and /var/log/utmp (mabe even
    > /var/log/lastlog) - anyway, the point is, it uses those files to get the
    > information, now, it appears as if they have become corrupt, mabe by
    > userland/kernel land desynch? bad upgrade? tried a reboot?
    >
    > Else, can you give us more details about the system, past upgrades,
    > intrusions?

    Thanks for the explanation. I do understand the above and for sanity
    sake did every single thing to determine if my box was broken into.
    However, it turns out that the file did get corrupted (this behavior
    started to appear after a system reboot which required manual fsck).

    Simple re-creation of the file worked out just fine.
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"


  • Next message: Richard Coleman: "Re: TCP timestamp vulnerability"

    Relevant Pages

    • XP upgrade wont boot lost file system32NTOS.....exe
      ... Have a Dell Inspirion 4000 and the boot file is corrupt or can't be found. ... Tried to reboot from the CD, but it is the upgrade and doesn't boot from the CD. ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: upgrading Gutsy to Hardy, remotely .... advice and precautions?
      ... the upgrade should proceed with some possible package removals. ... a reboot will be required. ... system via remote. ... I'd make sure that ssh is installed and working before you start. ...
      (Ubuntu)
    • Re: Question on Mac files on a Windows 2003 Server
      ... shuts down on a reboot resulting in a mismatch and index rebuild on restart. ... > log file says even users files that don't use the Mac just PC. ... > So would you recommend a reboot of the server just to see what happens? ... >> This looks like index files for the various volumes is corrupt and being ...
      (microsoft.public.win2000.macintosh)
    • Trouble upgrading Squeeze
      ... I have Sqeeze on my laptop and have not done an upgrade in quite some ... Sometimes I have needed to remove the lock file, ... Now I am afraid to power down and reboot, ...
      (Debian-User)
    • Re: WMP 11 Erased all my custom tags
      ... WMP 11 Beta initialized an automatic upgrade to WMP 11 today. ... This is not accurate -- the saved files cannot work with the new WMP. ... The suggestion on the table is that ONLY a corrupt beta/old library can ...
      (microsoft.public.windowsmedia.player)