Has this box been hacked?

[Ted Mittelstaedt]

When I am in that same position as a rule I tell the customer
that I would assume the system was rooted.

The reason is that all of the times I've been called in on
this type of job it has been because the previous admin was
fired and they wanted to make sure he wasn't getting back
in remotely and causing problems.

You didn't say the circumstances behind this job of yours, but
clearly, since this is a FreeBSD 4.11 system it's been built
within the last 6 months.  Now, the person that built it isn't
around?  Otherwise why would they be callin you in?  You should
assume the previous person that setup this system left some back
doors.

Ted