Date: Fri, 4 May 2001 09:07:56 -0500 (CDT) From: "Jonathan M. Slivko" <jslivko@jeah.net> To: "Kasper (swebase)" <kasper@swebase.com> Cc: <freebsd-questions@FreeBSD.ORG> Subject: Re: Server hangs. Message-ID: <20010504090619.Q96554-100000@awww.jeah.net> In-Reply-To: <000f01c0d4a1$ef685830$642750d5@swebasekasper>
next in thread | previous in thread | raw e-mail | index | archive | help
Do you have any kind of CGI's running on this machine for a webserver, etc? What that appears to be is a message that's telling you that something is trying to access a file called /etc/spwd.db by either a program or a username by the name of cgiwrap. I would, just to be on the safe side, sniff around the machine a little bit, see if anything else peculiar shows up. If so, then you may have a hacked box on your hands. -- Jonathan M. Slivko ----------------------------------------------------------- Jonathan M. Slivko | e-mail: jslivko@jeah.net Sys. Admin, DataSyrgeINET | http://www.datasyrge.net Tech. Support, SimpHost | http://www.simphost.com IRC Oper, AsylumNet IRC | http://www.asylum-net.org ---------------------------------------------------------- FreeBSD -- The Power to Serve! http://www.freebsd.org On Fri, 4 May 2001, Kasper (swebase) wrote: > Suddenly the server hangs and must be restarted with the powerswitch. > > Iget this message before it dies. > > Message from syslogd@devil at Fri May 4 15:52:04 2001 ... > devil May 4 15:52:04cgiwrap: /etc/spwd.db > > Whats wrong? > > > Med v=E4nlig h=E4lsning > Swebase AB > Kasper Kristiansson > 042-162000, Fax 042-162009 > Mobil 070-8995989 > > Swebase AB. > http://www.swebase.com > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010504090619.Q96554-100000>