From owner-freebsd-questions Wed Aug 12 06:27:38 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id GAA26935 for freebsd-questions-outgoing; Wed, 12 Aug 1998 06:27:38 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from blues.jpj.net (blues.jpj.net [204.97.17.146]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id GAA26930 for ; Wed, 12 Aug 1998 06:27:37 -0700 (PDT) (envelope-from benh@blues.jpj.net) Received: from localhost (benh@localhost) by blues.jpj.net (backatcha) with SMTP id JAA04962; Wed, 12 Aug 1998 09:27:01 -0400 (EDT) Date: Wed, 12 Aug 1998 09:27:01 -0400 (EDT) From: Ben Hockenhull To: "sysadmin@mfn.org" cc: "'freebsd-questions@freebsd.org'" Subject: Re: "Intruder Alert"??? In-Reply-To: <01BDC59B.56235200@noc.mfn.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Chances are you have fortune turned on at login. That's one of the more, um, interesting fortunes. :) % grep -i intruder /usr/share/games/fortune/* will show you the light. Ben -- Ben Hockenhull benh@jpj.net On Wed, 12 Aug 1998, sysadmin@mfn.org wrote: > While sniffing my network in the middle of the night, > trying to figure out what the $^&*^ is going on here > with the crazy NFS problems here, I got the following > on my telnet login (prefaced with a couple of beeps): > > measl@smaug$ su -l root > su: kerberos: not in root's ACL. > Password: > ccd /Security check: INTRUDER ALERT! > > Where does this *come from*? I've never seen nor > heard of it before, so I have no way of trying to > look at whatever triggered it (probably me, but > who knows?). BTW: all looks normal in terms > of who is on and where they are on (as well as what > they are doing). > > > > J.A. Terranson > sysadmin@mfn.org > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message