 | View Full Version : Got hacked? TheRealDeal 02-01-2002, 05:01 AM Hi, I got a message from Mynetwatchman stating our server is port scanning other servers. Does this mean our server has been hacked? bitserve 02-01-2002, 07:36 AM Probably. Or one of your authorized users is doing it. TheRealDeal 02-03-2002, 02:03 PM IS there a log for authoriuzed user logins? I've did a uvscan and found 8 possible infections. Could this be the reason for the unknown portscans? ffeingol 02-03-2002, 02:11 PM What os? Frank TheRealDeal 02-03-2002, 07:20 PM Originally posted by ffeingol What os? Frank Red hat 7.1 ffeingol 02-03-2002, 07:24 PM ok, to see who was logged on when (and for how long) just type "last". It will whizz by, so you might want to pipe it through more (i.e. last | more). You also should be able (as root) to look at their .bash_history files to see who was doing what. Frank |