Article View: comp.security.misc
Article #300hushlogin
From: Frank Henderson
Date: Thu, 27 Aug 1992 20:03
Date: Thu, 27 Aug 1992 20:03
33 lines
2077 bytes
2077 bytes
I checked the FAQ and searched all available posts and RT_M, but
I can't find any info on hushlogin as mentioned in CERT-92:14 -->
2. If the check from (A.1) indicates that your binaries have been
modified, check for the presence of a password
log file. Since the name of the logfile is often changed,
the name of the file should be obtained using the
"strings(1)" command on the Trojan login, uucpd, or telnet
binary. Examples of filenames used on other systems are:
"/usr/spool/. " (dot space)
"/var/spool/secretmail/.l"
"/var/spool/secretmail/.log"
"/var/spool/secretmail/.tty"
"/var/spool/secretmail/.lock"
"/usr/tmp/.log"
"/usr/spool/uucp/.sys"
"/usr/spool/uucppublic/.hushlogin"
What is a .hushlogin file and why does my system have an empty
one in /usr/spool/uucppublic?
thanks.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Frank Henderson \ / E-mail: hendefd@tech.duc.auburn.edu
Network Technical Support \ _ / Auburn, AL
----/_\----
x--------------( . )--------------x
x|x | |_|\_/|_| | x|x
x x x x
CF-18 Hornet (by Paul Tomblin pt@geovision.gvc.com)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Technical Details
Message-ID:
<1992Aug27.200330.24859@news.duc.auburn.edu>Path:
arc1-ca.pugleaf.net!sparky!uunet!haven.umd.edu!darwin.sura.net!news.duc.auburn.edu!woof!hendefdShow Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!haven.umd.edu!darwin.sura.net!news.duc.auburn.edu!woof!hendefd From: hendefd@woof.duc.auburn.edu (Frank Henderson) Subject: hushlogin Message-ID: <1992Aug27.200330.24859@news.duc.auburn.edu> Sender: usenet@news.duc.auburn.edu (News Account) Nntp-Posting-Host: woof Reply-To: hendefd@woof.duc.auburn.edu Organization: Sun Microsystems, Inc. Date: Thu, 27 Aug 1992 20:03:30 GMT Lines: 36