On Tue, 29 Jun 2004, Dave wrote: > I don't really see a problem here. My mystery logins are actually still > continuing. I'm going to see if I can code a mousetrap to find out who is > doing it. I did a fresh source compile of world from the latest cvsup for > 5.2.1 REL, and ran mergemaster to look for differing startup scripts... > > No luck yet. I wrote down the byte-sizes of sockstat, ps, and getty on a > piece of paper. I'm going to watch them over the next couple of days. md5 sums are generally better for this sort of thing. It's not all that hard to pad a file out to a desired size. Also, see /usr/ports/security/l5 for a minimalist tool which is useful for listing file data including md5 sums, file sizes, permissions, etc. Andrew -- No added Sugar. Not tested on animals. May contain traces of Nuts. If irritation occurs, discontinue use. ------------------------------------------------------------------- Andrew McNaughton Living in a shack in Tasmania [email protected] Between the bush and the sea Mobile: +61 422 753 792 http://staff.scoop.co.nz/andrew/cv.doc http://www.scoop.co.nz/ _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"