RE: [cobalt-users] pkg.nl.cobalt - Open SSH

[SM <nntp@xxxxxxxxx>]

Hi,
At 15:56 04-01-2002 -0000, Liam Delahunty wrote:
>Please forgive the newbie question, but just out of interest, (as I do patch
>pretty much straight away), how would one know if the system has been
>compromised?

There isn't a point and click way to find out whether a system has been
compromised.  Keep an eye on the logs, the last logins, the processes which
are running and the ports which are listening.  The person can always alter
the logs, modify ps to hide what he/she doing.  You can do a md5 checksum
on the system binaries to see whether they have been tampered with.

Regards,
-sm