logins

[Mark]

On Tue, Aug 17, 2004 at 11:17:46AM -0400, Lowell Gilbert wrote:
> Mark <boxend at redtick.homeunix.com> writes:
> 
> > I've beend getting the sshd login attempts, like everyone else so I've been 
> > watching the logs close, this is the first time to see this item in /var/log/messages. 
> > Aug 14 04:15:00 chillico su: _secure_path: /nonexistent/.login_conf is not owned by uid 65534
> 
> The machine doesn't have a '/nonexistent/' directory, does it?  
> It is important security-wise that such a directory must *not* exist.

 It was there but is now gone. 
> 
> > I've looked in the passwd file and groups, there is not a uid of 65534 listed.
> 
> There *should* be; it's "nobody".  And it shouldn't be in the wheel group.

 You are right nobody does have that uid and it's not in the wheel group.
> 
> > I installed rsync last week to backup some windows computers during the weekend, this would have been
> > during one of the backups, but the other five would have triggered the same msg, just thinking outloud here.
> 
> Unless /nonexistent got created during the process...

thanks, After deleteing the nonexistent dir, I thought about the creation date and time stamp. =( 

    

>______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"

-- 
------------------------------------------------------------------------------
**********
The information contained in this communication is confidential, private,
proprietary, or otherwise privileged and is intended only for the use of the
addressee.  Unauthorized use, disclosure, distribution or copying is strictly
prohibited and may be unlawful.  If you have received this communication in
error, please notify the sender immediately.
**********
==============================================================================