Re: [[cobalt-users] Server Hacked?]

["Richard E. Perlotto II" <richard@xxxxxxxxxxxx>]

Hmm, ftp logins as well....  sheesh, it seems knowing Unix is not the
same as knowing Linux... sigh.

The different tty0... are all the pseudo terminals that are created
as people login.  Another good command is a 'who -u' which will give
you the amount of idle time the user has.  I have noticed that on
the Linux servers that shells sometimes hang around and I have to
kill them manually.


Richard

Dennis wrote:
> 
> Richard-
> 
> When I run the last command I also get a listing of all the ftp logins.
> Also whats the difference between tty0 tty1 tty2 and tty3?
> 
>     -Dennis
> 
> "Richard E. Perlotto II" wrote:
> 
> > The last command will not show FTP access to the box, only login access
> > to include login, telnet, rsh, rlogin (at least on a standard Unix box)
> >
> > Richard
> >
> > manitu wrote:
> > >
> > > > The 'last' command will tell you all the people that have logged
> > > > in assuming that they have not hacked your log files.
> > >
> > > Does this only show the telnet-logins or all logins (also ftp etc.) ?
> > >
> > > Manuel
> > >
> > > _______________________________________________
> > > cobalt-users mailing list
> > > cobalt-users@xxxxxxxxxxxxxxx
> > > http://list.cobalt.com/mailman/listinfo/cobalt-users
> 
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-users

begin:vcard 
n:Perlotto;Richard
x-mozilla-html:FALSE
url:http://www.perlotto.com
org:Home
adr:;;;;;;
version:2.1
email;internet:richard@xxxxxxxxxxxx
x-mozilla-cpt:;-1
fn:Richard Perlotto
end:vcard