Re: how to tell whe you have a hacker?

Top Page
Attachments:
Message as email
+ (text/plain)
Delete this message
Reply to this message
Author: Jeremy C. Reed
Date:  
To: Main PLUG discussion list
Subject: Re: how to tell whe you have a hacker?
On Fri, 17 Feb 2006, Mike wrote:

> but will there be extra processes or can they get in without a new process?


A cracker usually starts new processes.

> I have a process running that I do not remember from dial-up days. It is
> ssh-agent (secure shell?) but it is probably only because I now use
> cable-net.


I also use ssh-agent.

Run "env" and see if you have a SSH_AUTH_SOCK and SSH_AGENT_PID defined.
If so, see if that SSH_AGENT_PID matches your process id of ssh-agent.
And see if the file referenced by SSH_AUTH_SOCK is owned by you.

If you have the SSH_AUTH_SOCK environment variable set, you can run
"ssh-add -l" to list the identities that ssh-agent has loaded.

If you don't have those environment variables, look for a
/tmp/ssh-*/agent* file and see who owns it.


Jeremy C. Reed

                 technical support & remote administration
                http://www.pugetsoundtechnology.com/
---------------------------------------------------
PLUG-discuss mailing list - 
To subscribe, unsubscribe, or to change  you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss