Hey! I've got similar entries in my wtmp, too!!! Looks like this: ?***?*** ******G**> ***********;*0* Sat Sep 16 02:00 still logged in ******O= *****&**?** **^******s5y*_ Fri Oct 4 03:00 still logged in **S5**** ****f**!**s* R*O)***kky*U***Y Wed Jul 4 20:37 still logged in ?**R**> ***2*b***^}* f*5********%5*U* Thu Aug 31 22:24 still logged in *"~*gi** **g***;***** ***Q**J--***** Mon Mar 17 07:18 still logged in *****/*j *********BX* **F5*****(***^*O Tue Dec 17 02:23 still logged in **.**n** **? ******.J **,k~***e**~**!* Fri Jun 7 13:37 still logged in *K*:**~* ****?<***l* **}*ak*5**5*j** Sun Apr 3 14:53 still logged in *****4!) Q*b****YA**F ***?/u*********& Thu Jan 21 18:52 still logged in U******r ******a***** 8**$**H***/'**** Tue Apr 3 03:58 still logged in The system is SuSE 7.3, kernel 2.4.10 (yes, know it's a bit old now)... And another one with SuSE 8.0 2.4.18-4GB shows: ****`*** `*******`*** ****`*******`*** Thu Jan 1 01:00 gone - no logout Any ideas? Eduard --- Philippe Vogel <filiaap@freenet.de> wrote:
Sounds very spooky, but which console ...
pep@montblanc:~> last pep pts/1 Sun Feb 2 20:02 still logged in pep pts/0 Sun Feb 2 20:00 still logged in P***(*** ****P***h*** ********P******* Thu Jan 1 01:00 gone - no logout pep pts/2 Sat Feb 1 23:43 - 23:44 (00:00) pep pts/2 Sat Feb 1 23:35 - 23:37 (00:01) pep pts/1 Sat Feb 1 23:34 - 23:44 (00:10) si mon pts/0 pooladsl-a-25-7. Sat Feb 1 22:55 - 01:14 (02:19) camio pts/0 Sat Feb 1 20:59 - 21:55 (00:55) P***h*** ****P***(*** ***** Thu Jan 1 01:00 gone - no logout
pts/x means from remote via ssh. plz be more precise. Is he/she in your /etc/passwd ???
better make a lastlog>out.txt and a http://www.chkrootkit.org/ or a http://www.rwth-aachen.de/security/s30.html (sorry this is in german) !!!
Philippe
-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here
__________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com