From owner-freebsd-questions  Thu Jun 27  8:32:14 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from seven.slakin.net (adsl-67-112-126-134.dsl.pltn13.pacbell.net [67.112.126.134])
	by hub.freebsd.org (Postfix) with ESMTP id 996DA37B406
	for <questions@freebsd.org>; Thu, 27 Jun 2002 08:32:11 -0700 (PDT)
Received: from localhost (localhost.slakin.net [127.0.0.1])
	by seven.slakin.net (Postfix) with ESMTP id 52F7377B
	for <questions@freebsd.org>; Thu, 27 Jun 2002 08:32:13 -0700 (PDT)
Date: Thu, 27 Jun 2002 08:32:13 -0700 (PDT)
From: Matt Snow <drama@slakin.net>
To: questions@freebsd.org
Subject: How do I tell if I got rooted via OpenSSH?
Message-ID: <20020627082611.T2681-100000@seven.slakin.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

I apologize if this has already been addressed on the list but I have
not had the time to read all of the thread's on this subject...

Is there anything in my logs that would indicate an attempted break in?
I have my system logging locally and to a syslog server.

* * * * * * * *
Matt Snow
 (@) drama@slakin.net
 (w) http://slakin.net.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message