Re: [cobalt-users] Raq550 - .bash_history size is 0

[Jeff Lasman <blists@xxxxxxxxxxxxx>]

On Monday 08 March 2004 02:11 pm, JMG Enterprises Support wrote:

> On one of our Raq550's, we got a chkrootkit message that the Root
> .bash_history file size was 0 bytes.  I think this measn that someone
> logged in and deleted this file to cover their tracks.   Though I
> changed my password and have searched for any problems (& found
> none), I want to know if there is a way to see what was done.  Has
> anyone found anything out of the ordinary that I should look for?

Could be, but if you delete /root/.bash_history and then logout it 
should build another /root/.bash_history showing at leat the delete 
command.

If the most recent chkrootkit shows no problems you'll probably have to 
live with that.  Unless you can see some other anomalies.

Jeff
-- 
Jeff Lasman, nobaloney.net, P. O. Box 52672, Riverside, CA  92517 US
Professional Internet Services & Support / Consulting / Colocation
Our blists address used on lists is for list email only
Phone +1 909 324-9706, or see: "http://www.nobaloney.net/contactus.html";