Re: [vox-tech] Things changing overnight

[Ken Bloom <kabloom@ucMAPSdavis.edu>]

On 2003.08.09 22:47, Ken Bloom wrote:
> Sometime in the past few days, my modem /dev/ttyS4 changed its 
> permissions from 660 to 640 without my intervention. My first 
> question: is there any kind of security package on debian that might 
> have done this as a cronjob? I don't use devfs.
I'm thinking this might now be the responsibility of /etc/init.d/
makedev, but haven't found the bug that would be causing this yet. 
(nothing on b.d.o describes this)

> When asking on #debian, a user suggested that I check my logs to see 
> if I had been hacked. I found in /var/logs/auth.log that the command 
> `su` had been run to switch from user `root` to user `nobody` at 3:35 
> this morning, a time when I was not connected to the internet (I use 
> ppp to connect through my modem). My second question: any idea what 
> might have done this? (obviously, I'd like to avoid a reinstall)
I wasn't rooted. It seems that updatedb (called by /etc/init.d/find) 
does this as a part of its normal operation.

> (I can't seem to find any cronjob that would be doing this, but it
> would help if you had any suggestions)
>
> I am running a Debian sarge/sid mixed box.
--
I usually have a GPG digital signature included as an attachment.
If you don't know what it is, either ignore it or visit www.gnupg.org
My PGP key was last signed 6/10/2003 please download my key again if
it is more recent than your copy. If you use GPG, *please* talk to
me to sign it. The key is keyID E2B2CAD1 on pgp.mit.edu

Attachment: pgp00001.pgp
Description: PGP signature