From owner-freebsd-hackers  Fri Aug  7 23:41:47 1998
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id XAA08043
          for freebsd-hackers-outgoing; Fri, 7 Aug 1998 23:41:47 -0700 (PDT)
          (envelope-from owner-freebsd-hackers@FreeBSD.ORG)
Received: from lariat.lariat.org ([206.100.185.2])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id XAA08003;
          Fri, 7 Aug 1998 23:41:35 -0700 (PDT)
          (envelope-from brett@lariat.org)
Received: (from brett@localhost)
	by lariat.lariat.org (8.8.8/8.8.6) id AAA16434;
	Sat, 8 Aug 1998 00:41:05 -0600 (MDT)
Message-Id: <199808080641.AAA16434@lariat.lariat.org>
X-Sender: brett@127.0.0.1
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.1 
Date: Sat, 08 Aug 1998 00:40:49 -0600
To: dima@best.net, dg@root.com
From: Brett Glass <brett@lariat.org>
Subject: Re: Does this mean we have another breakin?
Cc: roberto@keltia.freenix.fr, FreeBSD-security@FreeBSD.ORG,
        hackers@FreeBSD.ORG
In-Reply-To: <199808080403.VAA05702@burka.rdy.com>
References: <199808080135.SAA00798@implode.root.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

At 09:03 PM 8/7/98 -0700, Dima Ruban wrote:
 
>We usually get this bug once in two weeks. But since file by itself
>stays the same and machine doesn't crash, fixing/finding the problem
>wasn't in out TODO list.

The MD5 of the file stayed the same, and diff reveals no change. But
we can't turn off the alarm that's triggered by the date change in
/usr/sbin without potentially missing breakins, so our two new admins 
are constantly getting scary messages.

--Brett


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message