Hacked or not ?

[Alex Povolotsky]

On Sat, 12 Jun 2004 14:39:21 +0200
"Peter Rosa" <prosa at pro.sk> wrote:

PR> But what about the /var/log/messages logs absence ?
PR> And, how to test the machine, if it is healthy ?

Boot from CD and compare md5 checksums on system files. That's the first step.

Compare your kernel sources with clean ones, rebuild kernel and compare it with the running one. If you're running GENERIC, compare it with the distributed one.

Compare /modules directory with distribution one.

Check your (and system) .profile or .login etc.

After this step, you should have reasonably clean system.

-- 
Alex.