Hello fellow admin,
Following on from Harry Hahn <h3_at_ucla.edu> poster:
http://www.ornl.gov/its/archives/mailing-lists/alpha-osf-managers/1998/10/msg00245.html
Some of our Personal Workstations 500au (Digital UNIX V4.0D) are crashing
mysteriously and we am becoming increasing concerned that we might be
subject to a hacker exploiting a Tooltalk RPC client hack (now widely
published). We are aware that some errors may appear in the "user.log" if
a user exit CDE while one (or more) Tooltalk application are running. I
refer you to Ian Eaton <eatoni_at_hotmail.com> poster:
http://www.ornl.gov/its/archives/mailing-lists/alpha-osf-managers/1998/08/msg00175.html
However, our "user.log" contains many of the following entries:
-- cut --
Oct 29 10:14:48 alpha11 syslog: libtt[15622]: _Tt_rpc_client::init(): fcntl(F_SETFD): m
Oct 29 10:14:48 alpha11 last message repeated 10 times
Oct 29 15:43:15 alpha11 syslog: libtt[27425]: _Tt_rpc_client::init(): fcntl(F_SETFD): m
Oct 29 15:43:15 alpha11 last message repeated 10 times
Oct 29 18:40:47 alpha11 syslog: libtt[26002]: _Tt_rpc_client::init(): fcntl(F_SETFD): m
-- cut --
On the last occurrence inspecting the "/var/adm/crash/crash-data.0" file we
notice that the "_current_pid" string pointed to "cfgmgr". We are certain
that we were not running this as the time of the crash. In addition, we
have "/etc/cfgmgr.auth" configured. I appreciate that the system may
periodically run "cfgmgr" so we might be barking up the wrong tree.
Any help, advice or location of any DEC patch would be very welcome.
As usual, summary to follow.
Regards,
Rich
/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ _ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
/_/ Richard A Bemrose /_\ Polymers and Colloids Group \_\
/_/ email: rb237_at_phy.cam.ac.uk /_\ Cavendish Laboratory \_\
/_/ Tel: +44 (0)1223 337 267 /_\ University of Cambridge \_\
/_/ Fax: +44 (0)1223 337 000 /_\ Madingley Road \_\
/_/ (space for rent) / \ Cambridge, CB3 0HE, UK \_\
/_/_/_/_/_/_/
http://www.poco.phy.cam.ac.uk/~rb237 \_\_\_\_\_\_\
"Life is everything and nothing all at once"
-- Billy Corgan, Smashing Pumpkins
Received on Thu Oct 29 1998 - 20:31:03 NZDT