full-disclosure - Re: sshd logins without a source

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 23 Sep 2011 11:07:44 +0000
From: james@...o-internet.org.uk
To: "Bacanu Adrian-Daniel" <darkzatarra@...oo.com>, "BH" <lists@...ckhat.bz>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: sshd logins without a source

Guys,

Let's not complicate this.

op: that looks like a line from /var/log/secure - this file only logs sessions, escalation and setuids, not ips. It is useful, in this situation, for tracing.

What do /var/log/[b|w]tmp tell you? Use the last command.

If this has been scrubbed then fine- these files can be scrubbed with a simple perl 2 liner, or rm'd completely.

Cheers.

Sent from my BlackBerry® wireless device

-----Original Message-----
From: Bacanu Adrian-Daniel <darkzatarra@...oo.com>
Sender: full-disclosure-bounces@...ts.grok.org.uk
Date: Fri, 23 Sep 2011 03:05:51 
To: BH<lists@...ckhat.bz>; full-disclosure@...ts.grok.org.uk<full-disclosure@...ts.grok.org.uk>
Reply-To: Bacanu Adrian-Daniel <darkzatarra@...oo.com>
Subject: Re: [Full-disclosure] sshd logins without a source

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/