root login stops working

[Chad Perrin]

On Sat, May 10, 2008 at 11:00:41PM +0200, Mel wrote:
> On Saturday 10 May 2008 20:50:46 Dennis Flynn wrote:
> > I'm running FreeBSD wx.dennis-flynn.net 7.0-RELEASE FreeBSD 7.0-RELEASE #0:
> > Sun Feb 24 19:59:52 UTC 2008    
> > root at logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386
> >
> > About a day after install root login no longer works - even on the console.
> >
> > I see the following in /var/log/auth.log:
> > May 10 14:22:37 wx sshd[86223]: Accepted password for root from
> > 10.11.12.104 port 1492 ssh2 May 10 14:22:37 wx sshd[86223]: Received
> > disconnect from 10.11.12.104: 0:
> >
> > And in /var/log/messages:
> > May 10 14:27:51 wx kernel: pid 86237 (csh), uid 0: exited on signal 11
> > (core dumped)
> 
> Looks like you got hacked, the tell-tale being "ip port ####".
> http://security.freebsd.org/advisories/FreeBSD-SA-08:05.openssh.asc

. . . unless that's part of Dennins' network setup.

-- 
CCD CopyWrite Chad Perrin [ http://ccd.apotheon.org ]
McCloctnick the Lucid: "The first rule of magic is simple. Don't waste your
time waving your hands and hopping when a rock or a club will do."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20080511/88e7aea0/attachment.pgp