Hello,
Recently, while looking through the history of logins I came across
several entries to user 'LOGIN':
-- cut --
# last | grep LOGIN
LOGIN console Tue May 26 19:39 - 19:39 (00:00)
LOGIN console Sun May 24 13:38 - 13:38 (00:00)
LOGIN console Sun May 24 13:38 - 13:38 (00:00)
etc etc
# ac LOGIN
total 176.23
-- cut --
However, no such account exists! There also seems to be contradiction
with the total connection times between 'last' and 'ac'.
Are these entries anything to do with Samba and Exceed? If not, then what
or who is logging in. Are we being hacked? Can I better trace who is
logging in or out?
Any suggestions would be appreciated. Summary to follow.
Thanks in advance.
Regards,
Rich
/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ _ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
/_/ Richard A Bemrose /_\ Polymers and Colloids Group \_\
/_/ email: rb237_at_phy.cam.ac.uk /_\ Cavendish Laboratory \_\
/_/ Tel: +44 (0)1223 337 267 /_\ University of Cambridge \_\
/_/ Fax: +44 (0)1223 337 000 /_\ Madingley Road \_\
/_/ (space for rent) / \ Cambridge, CB3 0HE, UK \_\
/_/_/_/_/_/_/
http://www.poco.phy.cam.ac.uk/~rb237 \_\_\_\_\_\_\
"Life is everything and nothing all at once"
-- Billy Corgan, Smashing Pumpkins
Received on Mon Jun 01 1998 - 13:02:09 NZST