From owner-freebsd-questions@FreeBSD.ORG Tue Aug 17 15:46:14 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 783BE16A4CE for ; Tue, 17 Aug 2004 15:46:14 +0000 (GMT) Received: from redtick.homeunix.com (adsl-68-89-249-225.dsl.okcyok.swbell.net [68.89.249.225]) by mx1.FreeBSD.org (Postfix) with ESMTP id EAD4543D31 for ; Tue, 17 Aug 2004 15:46:13 +0000 (GMT) (envelope-from boxend@redtick.homeunix.com) Received: from redtick.homeunix.com (localhost.homeunix.com [127.0.0.1]) i7HFicHi020025; Tue, 17 Aug 2004 10:44:38 -0500 (CDT) (envelope-from boxend@redtick.homeunix.com) Received: (from boxend@localhost) by redtick.homeunix.com (8.12.10/8.12.10/Submit) id i7HFicmb020024; Tue, 17 Aug 2004 10:44:38 -0500 (CDT) (envelope-from boxend) Date: Tue, 17 Aug 2004 10:44:38 -0500 From: Mark To: Lowell Gilbert Message-ID: <20040817154438.GA19940@redtick.homeunix.com> References: <200408171508.i7HF832Z018959@redtick.homeunix.com> <448ycdhjz9.fsf@be-well.ilk.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <448ycdhjz9.fsf@be-well.ilk.org> User-Agent: Mutt/1.4.2.1i cc: freebsd-questions@freebsd.org Subject: Re: logins X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Aug 2004 15:46:14 -0000 On Tue, Aug 17, 2004 at 11:17:46AM -0400, Lowell Gilbert wrote: > Mark writes: > > > I've beend getting the sshd login attempts, like everyone else so I've been > > watching the logs close, this is the first time to see this item in /var/log/messages. > > Aug 14 04:15:00 chillico su: _secure_path: /nonexistent/.login_conf is not owned by uid 65534 > > The machine doesn't have a '/nonexistent/' directory, does it? > It is important security-wise that such a directory must *not* exist. It was there but is now gone. > > > I've looked in the passwd file and groups, there is not a uid of 65534 listed. > > There *should* be; it's "nobody". And it shouldn't be in the wheel group. You are right nobody does have that uid and it's not in the wheel group. > > > I installed rsync last week to backup some windows computers during the weekend, this would have been > > during one of the backups, but the other five would have triggered the same msg, just thinking outloud here. > > Unless /nonexistent got created during the process... thanks, After deleteing the nonexistent dir, I thought about the creation date and time stamp. =( >______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" -- ------------------------------------------------------------------------------ ********** The information contained in this communication is confidential, private, proprietary, or otherwise privileged and is intended only for the use of the addressee. Unauthorized use, disclosure, distribution or copying is strictly prohibited and may be unlawful. If you have received this communication in error, please notify the sender immediately. ********** ==============================================================================