From owner-FreeBSD-users-jp@jp.freebsd.org  Thu Apr 15 20:17:52 1999
Received: by jaz.jp.freebsd.org (8.9.2+3.1W/8.7.3) id UAA02255;
	Thu, 15 Apr 1999 20:17:52 +0900 (JST)
	(envelope-from owner-FreeBSD-users-jp@jp.FreeBSD.org)
Received: from mx.jaif.or.jp (ns.jaif.or.jp [202.223.55.10])
	by jaz.jp.freebsd.org (8.9.2+3.1W/8.7.3) with ESMTP id UAA02247
	for <FreeBSD-users-jp@jp.freebsd.org>; Thu, 15 Apr 1999 20:17:50 +0900 (JST)
	(envelope-from hatori@jaif.or.jp)
Received: from jaif.or.jp ([210.142.4.20]) by mx.jaif.or.jp (8.8.7/3.4W412/02/96) with ESMTP id LAA00145 for <FreeBSD-users-jp@jp.freebsd.org>; Thu, 15 Apr 1999 11:32:32 GMT
Message-ID: <3715CB4C.AD66E150@jaif.or.jp>
Date: Thu, 15 Apr 1999 20:19:40 +0900
From: Kentaro Hatori <hatori@jaif.or.jp>
Organization: PASCO Corporation
X-Mailer: Mozilla 4.5 [ja] (WinNT; I)
X-Accept-Language: ja, en,ko
MIME-Version: 1.0
To: FreeBSD-users-jp@jp.freebsd.org
References: <37144E2D.708CCE02@jaif.or.jp>
		    <19990414173239Y.hirano@t.kanazawa-u.ac.jp>
		    <37145F6E.F12B08AF@jaif.or.jp> <199904141000.TAA08260@vaio.he.kobelcosys.co.jp>
Content-Type: text/plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Reply-To: FreeBSD-users-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+990405
X-Sequence: FreeBSD-users-jp 41294
Subject: [FreeBSD-users-jp 41294] Re: How do you do about illeagal access on 
 your host?
Errors-To: owner-FreeBSD-users-jp@jp.freebsd.org
Sender: owner-FreeBSD-users-jp@jp.freebsd.org
X-Originator: hatori@jaif.or.jp

$B$O$H$A$c$s(B@$B%Q%9%3$G$9(B

Toshihiko Ueki/$B?"LZIRI'(B wrote:
> $B?"LZ$G$9!#$3$s$P$s$O!#(B

$B$*@$OC$K$J$j$^$9!#(B

> >$B:G=i$KIT@5%"%/%;%9$5$l$?$H$-$K!"(Bfbsdrootkit$B$J$k$b$N$r2rE`$7$F<B9T(B
> >$B$7$?MzNr$,;D$C$F$$$^$9!#(B
> 
> $B$3$NMzNr$O$I$3$K5-O?$5$l$F$$$?$b$N$G$7$g$&(B ?
> # $B%7%9%F%`$N%"%+%&%s%F%#%s%05-O?$G$7$g$&$+(B ?

$B$3$l$OIT@5%"%/%;%9$5$l$?%f!<%6$N%[!<%`%G%#%l%/%H%j$K;D$C$F$$$?(B
.history$B$K$"$j$^$7$?!#$+$J$j%/%i%C%+!<$H$7$F$O=i?4<T$J$s$G$7$g$&$M(B
$B$H46?4$7$F$P$+$j$b$$$i$l$J$$$N$G$9$,(B...

> >Apr 14 18:30:00 hogehoge CRON[23130]: (root) CMD (/usr/libexec/atrun)
> >Apr 14 18:35:00 hogehoge CRON[23153]: (root) CMD (/usr/libexec/atrun)
> >Apr 14 18:40:00 hogehoge CRON[23168]: (root) CMD (/usr/libexec/atrun)
> >$B$H$J$C$F$$$F!"$3$l$G(Bcomsat$B$,<B9T$5$l$?$N$+$J$!$H$b;W$$$^$9!#(B
> 
> $B$3$l$OJL$KLdBj$J$$$N$G$O$J$$$G$7$g$&$+(B ?   /etc/crontab $B$rJQ99$7$F$$$J(B
> $B$1$l$P(B 5 $BJ,$4$H$KF0$/$O$:$G$9$M!#(B

$B$3$N%f!<%6$O!"B>$N%f!<%6$HF1$8$h$&$K(BMicrosoft$B@=(BOS$B$N%/%i%$%"%s%H$G$9(B
$B$N$G(Bbiff$B$N@_Dj$r(Byes$B$K$9$k$o$1$,$J$$$s$G$9$M!#$=$l$G(Bbiff$B$N@_Dj$,(Byes
$B$K$J$C$F$$$F(Bcomsat$B$rF0$+$7$F$$$k$N$G!"(Bcomsat$B$K$J$K$+;E3]$1$,$"$k$s$8$c(B
$B$J$$$+$HF'$s$@$o$1$G$9!#(B

> $B30It%5%$%H$+$i(B IP $B%j!<%A%c%V%k$J%^%7%s$N$h$&$G$9$N$G!"(Btcp_wrappers $B$O(B
> $BF~$l$F$*$$$?J}$,NI$$$G$7$g$&!#(B

$B$"$j$,$H$&$4$6$$$^$9!#(B
tcp_wrappers$B$rD4$Y$F$_$^$9!#(B

-- 

    /   / Kentaro Hatori
   __  /  mailto:hatori@jaif.or.jp
 _/  _/   $B8e8~$-$N;E;v$@$1$I4IM}$7$J$+$C$?Js$$$+$J(B
