Possible compromise ?

[D J Hawkey Jr]

On Jan 27, at 05:44 PM, Peter Rosa wrote:
> 
> Hello,
> 
> please, is there some way to list ALL users, who connect remotely to my
> machine ? It is our gateway, so it should be one-user machine, but if I list
> /var/log/lastlog binary file, there are some lines showing usage of ttyp0.

`man lastlog` explains that file (and others), and the "SEE ALSO" section
lists pertinent commands.

> That console I have disabled in ttys, so why there are that lines ? How
> could I make FreeBSD to show that file in readable way ?

`man last`.

> Was my machine compromised ?

Not enough info to go on. `last` just may show the last time the admin
was on tty0, disabling tty0.

Dave

-- 
  ______________________                         ______________________
  \__________________   \    D. J. HAWKEY JR.   /   __________________/
     \________________/\     hawkeyd at visi.com    /\________________/
                      http://www.visi.com/~hawkeyd/