Sponsored Content
Top Forums UNIX for Dummies Questions & Answers Command is respawning too rapidly..message Post 39652 by OllieTech on Wednesday 27th of August 2003 04:52:00 AM
Old 08-27-2003
First, just friendly advice. What kind of security and hardening is going to be in place after the install? Hint: Do not connect this server to the net until it is done.

Second, I found some info that is not posted on here yet, but has probally been read by you guys on the newsgroups:

Quote:
Found the same compromise on a server i serviced today. They had added
an irc bouncer in the directory "/dev/cua/..." and modified the system
not to find any of their "root kit" modifications.

The srload is just a sshd deamon.

You will most likely have a file named /usr/lib/libp/libm.n that
contains logs for passwords from a sniffer named /usr/sbin/modstat.
Also found this http://groups.google.com/groups?hl=e...s.de&frame=off

Just remember that if you have been compromised, which you probally have, you can not trust any of your normal commands as they could have been easily replaced with hacked versions to either inflict more harm or hide the files that you are looking for to see if you have been compromised. So, essentially, nothing on that server whether user created data, system components, logs, or the such should be saved and reloaded on the new install without fully checking it over to verify accuracy.

Tripwire is a good security tool if you are not using it yet.

Hope that helps...

Last edited by OllieTech; 08-27-2003 at 05:57 AM..
 

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Some kind of message command

Hello All, hope someone here can help me with this. I am a new unix system administrator on the HP-UX machine. Every night, our operators back up our file system using one tape but as of recently, our files have gotten bigger and it now requires 2 tapes for a complete backup. Since the operators... (3 Replies)
Discussion started by: sanjit
3 Replies

2. UNIX for Advanced & Expert Users

not sure what this message means, last command

in the last command..........what's this mean? i truncated the user name for obvious reasons, b b rexecd Wed Jan 7 08:53 still logged in b rexecd Wed Jan 7 08:53 still logged in b rexecd Wed Jan 7 08:53 still logged in b rexecd Wed Jan 7 08:53 still... (1 Reply)
Discussion started by: csaunders
1 Replies

3. UNIX for Dummies Questions & Answers

HP-UX respawning boot failure

Hello. System is a HP Visualize C3600 running X11 and after a power failure machine will not boot (see error messages below) From what I've read, this may be caused by a corrupted etc/inittab file. Solution suggested on other websites is to boot in single user mode and edit file inittab... (2 Replies)
Discussion started by: westcoast
2 Replies

4. HP-UX

INIT: Command respawning too rapidly

INIT:Command is respawning too rapidly Check for errors: id:cons /usr/sbin/getty console console A solution I read about in a different HPUX Forums help pages on line, said to add the -h option to this command in the /etc/inittab file to correct the problem. I tried this and it did not... (2 Replies)
Discussion started by: 1bigdog
2 Replies

5. AIX

mkitab problem with /etc/inittab respawning

Hi All, May be a dumb question to old AIX hacks, if so apologize. I have worked with /etc/inittab on SCO, but apparently with AIX you should use the 'mkitab' command to add entries instead of just vi'ing the file. I just need a daemon process (script called 'dpr_daemon') to kick off once and... (19 Replies)
Discussion started by: jeffpas
19 Replies

6. Red Hat

ls command with a welcome message !

Dear Friends , Is it possible to generate a welcome message when I give the command "ls" from a particular user's home directory in Unix/Linux platform ? suppose , in following example , bash-3.00# whoami root bash-3.00# ls When I give ls command then it shows the output as... (2 Replies)
Discussion started by: shipon_97
2 Replies

7. Red Hat

Server load rapidly increases resulting in complete freeze

Hi All, I run Linux server that hosts PHP/MySQL web-projects. The problem is that it becomes irresponsive periodically, avg. load rapidly goes up to 100.0 and more and I have to do cold reboot. Usually this sudden increase happens in 1-2 mins and it's very difficult to catch this moment in... (0 Replies)
Discussion started by: livedatesearch
0 Replies

8. Shell Programming and Scripting

Please Help with AWK to parse rapidly changing XML messages

Hi Guy's Can I please get some help with this code. I have xml feed file which rapidly changing temporary file and I need to capture the content of this file as soon as data arrives. Example of the data Required data output Time is current time. This is awk code that I have so far... (4 Replies)
Discussion started by: James_Owen
4 Replies

9. Solaris

ZFS: /system/zones "respawning" on rpool

Hi, I have this fresh installation of Solaris 11.3 sparc. I have two zfs pools both using two disks in mirroring mode, both are online. I want to move /system/zones, currently rpool/VARSHARE/zones, from rpool to the other zfs pool so my zones don't consume space on the disks allocated to... (1 Reply)
Discussion started by: X96
1 Replies
MGE-SHUT(8)							    NUT Manual							       MGE-SHUT(8)

NAME
mge-shut - Driver for SHUT Protocol UPS equipment SYNOPSIS
mge-shut -h mge-shut -a UPS_NAME [OPTIONS] Note This man page only documents the hardware-specific features of the mge-shut driver. For information about the core driver, see nutupsdrv(8). SUPPORTED HARDWARE
mge-shut supports all recent Eaton, MGE and Dell UPS models which use the SHUT (Serial HID UPS Transfer) protocol. Older MGE models, such as Pulsar ESV+, Pulsar EX and Pulsar ES+, use the U-Talk protocol and should use the mge-utalk driver. EXTRA ARGUMENTS
This driver also supports the following optional settings: lowbatt=num Set the low battery warning threshold at which shutdown is initiated by upsmon(8). The factory default value is 30 (in percent), and can be settable depending on the exact model. offdelay=num Set the timer before the UPS is turned off after the kill power command is sent (via the -k switch). The default value is 20 (in seconds). Usually this must be lower than ondelay, but the driver will not warn you upon startup if it isn't. ondelay=num Set the timer for the UPS to switch on in case the power returns after the kill power command had been sent but before the actual switch off. This ensures the machines connected to the UPS are, in all cases, rebooted after a power failure. The default value is 30 (in seconds). Usually this must be greater than offdelay, but the driver will not warn you upon startup if it isn't. Some UPS'es will restart no matter what, even if the power is (still) out at the moment this timer elapses. In that case, you could try if setting ondelay = -1 in ups.conf helps. notification=num Set notification type to 1 (no), 2 (light) or 3 (yes). The default value is 3 (yes) because of some early Ellipse models which need it. KNOWN ISSUES
Repetitive timeout and staleness Some models tends to be unresponsive with the default polling frequency. The result is that you have some "data stale" errors in your system log. In this case, simply modify the general parameter "pollinterval" to a higher value (like 10 for 10 seconds). This should solve the issue. Using notification=3 might also help. AUTHOR
Arnaud Quette SEE ALSO
The core driver nutupsdrv(8) Internet resources The NUT (Network UPS Tools) home page: http://www.networkupstools.org/ Network UPS Tools 05/21/2012 MGE-SHUT(8)
All times are GMT -4. The time now is 11:28 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy