Joy Methew wrote:
> i login as a root than i run "last" command i m sending tha first 10 lines
> of last command...i thinks someone hack my system.i am sending history
> command output.
> now i remove .ssh directory and /var/tmp/*
>
> please suggest wat is this??
Hi,
if your system was compromised, then the most secure next step is to
reinstall the system.
What I can see in the bash history, the attacker downloaded and
installed custom software.
Please send the output from the following commands run as root:
ps aux
pstree
netstat -ntulp
getent passwd
Regards
--
Bohdan Sydor
RHC{E,I,X}
www.sydor.net
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
