have i been hacked?

[Matthew Seaman]

On Wed, Apr 14, 2004 at 04:08:08PM +0000, Daniela wrote:

[ size of the /bin/rcp executable ]

> That needn't be the case. Mine is 932532 bytes long (and it was already that 
> size after a fresh reinstall).
> And why? Debug symbols. I love to have them everywhere.
> Try to strip the file, and it will be much shorter.

Installed binaries should already be stripped if they're part of the
base system.  You have to make a special effort setting things in
/etc/make.conf to prevent binaries being stripped on installation.
The reason that rcp is so large on 4.x is that it's statically linked:

    % ls -la /bin/rcp
    -r-sr-xr-x  1 root  wheel  251572 Feb  7 12:43 /bin/rcp*
    % file /bin/rcp
    /bin/rcp: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (FreeBSD), for FreeBSD 4.9, statically linked, stripped

On recent 5.x, rcp will be linked against the shared libc and
consequently rather smaller in size.

	Cheers,

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20040414/0e76ca41/attachment.bin