lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <1268238523-1316776066-cardhu_decombobulator_blackberry.rim.net-44351020-@b26.c20.bise7.blackberry> Date: Fri, 23 Sep 2011 11:07:44 +0000 From: james@...o-internet.org.uk To: "Bacanu Adrian-Daniel" <darkzatarra@...oo.com>, "BH" <lists@...ckhat.bz>, "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk> Subject: Re: sshd logins without a source Guys, Let's not complicate this. op: that looks like a line from /var/log/secure - this file only logs sessions, escalation and setuids, not ips. It is useful, in this situation, for tracing. What do /var/log/[b|w]tmp tell you? Use the last command. If this has been scrubbed then fine- these files can be scrubbed with a simple perl 2 liner, or rm'd completely. Cheers. Sent from my BlackBerry® wireless device -----Original Message----- From: Bacanu Adrian-Daniel <darkzatarra@...oo.com> Sender: full-disclosure-bounces@...ts.grok.org.uk Date: Fri, 23 Sep 2011 03:05:51 To: BH<lists@...ckhat.bz>; full-disclosure@...ts.grok.org.uk<full-disclosure@...ts.grok.org.uk> Reply-To: Bacanu Adrian-Daniel <darkzatarra@...oo.com> Subject: Re: [Full-disclosure] sshd logins without a source _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists