RE: [cobalt-users] Raq550 - .bash_history size is 0

["JMG Enterprises Support" <JMG-Support@xxxxxxxxxxxxxxxxxxx>]

Jeff,

Thanks but the only thing that seems funny to me is that the phoenix.log has
not been updating for a while.  The date is about the time of that Kernel
update that kept rebooting the system but I am not sure about the exact
date.

John


---Original Message-----
From: cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx] On Behalf Of Jeff Lasman
Sent: Monday, March 08, 2004 7:36 PM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: Re: [cobalt-users] Raq550 - .bash_history size is 0

On Monday 08 March 2004 02:11 pm, JMG Enterprises Support wrote:

> On one of our Raq550's, we got a chkrootkit message that the Root
> .bash_history file size was 0 bytes.  I think this measn that someone
> logged in and deleted this file to cover their tracks.   Though I
> changed my password and have searched for any problems (& found
> none), I want to know if there is a way to see what was done.  Has
> anyone found anything out of the ordinary that I should look for?

Could be, but if you delete /root/.bash_history and then logout it 
should build another /root/.bash_history showing at leat the delete 
command.

If the most recent chkrootkit shows no problems you'll probably have to 
live with that.  Unless you can see some other anomalies.

Jeff
-- 
Jeff Lasman, nobaloney.net, P. O. Box 52672, Riverside, CA  92517 US
Professional Internet Services & Support / Consulting / Colocation
Our blists address used on lists is for list email only
Phone +1 909 324-9706, or see: "http://www.nobaloney.net/contactus.html";

_____________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users