Re: [Full-disclosure] sshd logins without a source

[james@xxxxxxxxxxxxxxxxxxxx]

Guys,

Let's not complicate this.

op: that looks like a line from /var/log/secure - this file only logs sessions, 
escalation and setuids, not ips. It is useful, in this situation, for tracing.

What do /var/log/[b|w]tmp tell you? Use the last command.

If this has been scrubbed then fine- these files can be scrubbed with a simple 
perl 2 liner, or rm'd completely.

Cheers.

Sent from my BlackBerry® wireless device

-----Original Message-----
From: Bacanu Adrian-Daniel <darkzatarra@xxxxxxxxx>
Sender: full-disclosure-bounces@xxxxxxxxxxxxxxxxx
Date: Fri, 23 Sep 2011 03:05:51 
To: BH<lists@xxxxxxxxxxx>; 
full-disclosure@xxxxxxxxxxxxxxxxx<full-disclosure@xxxxxxxxxxxxxxxxx>
Reply-To: Bacanu Adrian-Daniel <darkzatarra@xxxxxxxxx>
Subject: Re: [Full-disclosure] sshd logins without a source

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/