From owner-freebsd-questions Wed Aug 12 10:19:52 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id KAA00564 for freebsd-questions-outgoing; Wed, 12 Aug 1998 10:19:52 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from alpo.whistle.com (alpo.whistle.com [207.76.204.38]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id KAA00550 for ; Wed, 12 Aug 1998 10:19:49 -0700 (PDT) (envelope-from julian@whistle.com) Received: (from daemon@localhost) by alpo.whistle.com (8.8.5/8.8.5) id KAA19650; Wed, 12 Aug 1998 10:03:13 -0700 (PDT) Received: from current1.whistle.com(207.76.205.22) via SMTP by alpo.whistle.com, id smtpdF19631; Wed Aug 12 17:03:02 1998 Date: Wed, 12 Aug 1998 10:02:49 -0700 (PDT) From: Julian Elischer To: "sysadmin@mfn.org" cc: "'freebsd-questions@freebsd.org'" Subject: Re: "Intruder Alert"??? In-Reply-To: <01BDC59B.56235200@noc.mfn.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG looks like a fortune cookie to me..... On Wed, 12 Aug 1998, sysadmin@mfn.org wrote: > While sniffing my network in the middle of the night, > trying to figure out what the $^&*^ is going on here > with the crazy NFS problems here, I got the following > on my telnet login (prefaced with a couple of beeps): > > measl@smaug$ su -l root > su: kerberos: not in root's ACL. > Password: > ccd /Security check: INTRUDER ALERT! > > Where does this *come from*? I've never seen nor > heard of it before, so I have no way of trying to > look at whatever triggered it (probably me, but > who knows?). BTW: all looks normal in terms > of who is on and where they are on (as well as what > they are doing). > > > > J.A. Terranson > sysadmin@mfn.org > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message