[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [cobalt-users] BRT chkrootkit Release 0.39a-04 what next???
- Subject: Re: [cobalt-users] BRT chkrootkit Release 0.39a-04 what next???
- From: Bruce Timberlake <bruce@xxxxxxxxxx>
- Date: Sat Mar 22 14:31:01 2003
- Organization: BRTNet.org
- List-id: Mailing list for users to share thoughts on Sun Cobalt products. <cobalt-users.list.cobalt.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Sat March 22 2003 14:20, Gerald Waugh wrote:
> On Sat, 22 Mar 2003, wcstaff wrote:
> > > Open /etc/cron and give us a look.
> > > It could be just a root cron also
> > > To look at it try executing
> > > crontab -e to look at it.
> >
> > This is what is in there:
> > "/tmp/crontab.4563" 0L, 0C
> >
> > ????????
>
> Oops! I meant to say /etc/crontab
You did. When you do "crontab -e" the "/tmp/crontab.4563" is what
appears in the vi editor screen if there are no entries for root's
crontab.
chkrootkit adds itself to root's crontab, but all the system stuff
(where I'm guessing the ipchains bit is) will be in /etc/cron.daily,
etc.
- --
Bruce Timberlake
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+fOP1vLA2hUZ9kgwRAhOHAJ4mV9ZIAwO9LxYsxHbbF7fYD+cI7QCfShtL
xI1ZCO8YJRaULf+aTVnAN3U=
=hX9v
-----END PGP SIGNATURE-----