🚀 go-pugleaf

hendefd@woof.duc.auburn.edu (Frank Henderson) writes:

>I checked the FAQ and searched all available posts and RT_M, but
>I can't find any info on hushlogin as mentioned in CERT-92:14 -->

>       2. If the check from (A.1) indicates that your binaries have been
>	   modified, check for the presence of a password
>	   log file.  Since the name of the logfile is often changed,
>	   the name of the file should be obtained using the
>	   "strings(1)" command on the Trojan login, uucpd, or telnet
>	   binary.  Examples of filenames used on other systems are:

>                               "/usr/spool/. " (dot space)
>                               "/var/spool/secretmail/.l"
>                               "/var/spool/secretmail/.log"
>                               "/var/spool/secretmail/.tty"
>                               "/var/spool/secretmail/.lock"
>                               "/usr/tmp/.log"
>                               "/usr/spool/uucp/.sys"
>                               "/usr/spool/uucppublic/.hushlogin"

>What is a .hushlogin file and why does my system have an empty 
>one in /usr/spool/uucppublic?

A .hushlogin prevents startup messages (like /etc/motd and
``You have mail''). .hushlogin is also recommended for
non human users, as the contents of /etc/motd can confuse
e.g., uucico. That is precisly the reason (I think) that
Sun ships an empty .hushlogin file in /usr/spool/uucppublic.

If things are normal, /usr/spool/uucppublic/.hushlogin has the same
last modified date as the bulk of the OS files.

Casper
-- 
						|	Casper H.S. Dik
						|	casper@fwi.uva.nl