Re: Compromised FBSD/Apache

• Original Message ----- From: "Greg A. Woods" <woods@weird.com> To: "Greg S. Wirth" <greg@beldamar.com> Cc: <incidents@securityfocus.com> Sent: Monday, November 18, 2002 11:49 AM Subject: Re: Compromised FBSD/Apache

> [ On Saturday, November 16, 2002 at 08:11:44 (-0900), Greg S. Wirth
wrote: ]
> > Subject: Compromised FBSD/Apache
<woods@robohack.ca>
> Planix, Inc. <woods@planix.com>; VE3TCP; Secrets of the Weird
<woods@weird.com>
>
> --------------------------------------------------------------------------

--

> This list is provided by the SecurityFocus ARIS analyzer service.

> For more information on this free incident handling, management

> and tracking system please see: http://aris.securityfocus.com

>


"sockstat" on later versions of FreeBSD will also show you the daemon
running on the port.

micheal@/>sockstat |more
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
root     sshd     62252    5 tcp4   192.168.1.1:22        192.168.1.2:3777
root     sshd       207    4 tcp4   *:22                  *:*


--

Micheal Patterson
Network Administration
Cancer Care Network



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com