[09:57] zed: ping [09:58] ups, sorry. Did not read backlog, apollo just told me ;) [14:04] 2/clear [14:04] raté [14:09] zed: should I understand that? [14:09] apollo13: no :) [14:09] ok, so hows eshu :) [14:10] ahem... how do I say that, I rebooted eshu in "rescue" mode [14:10] and it seems like it has been rooter [14:10] rooted [14:10] yikes [14:10] yup [14:11] we should apply updates from time to time hm? [14:11] don't know how it got in (pop3 user apparently, but I don't know why there was a pop3 :p) [14:11] and then eshu : old kernel [14:11] root exploit [14:11] damn [14:12] okay, what do we do now [14:12] i'll get all the data I can [14:12] (mailman, exim config etc...) [14:12] and reinstall the machine [14:12] don't we have backups anyways [14:12] btw should we check the nfs [14:12] and wasn't backupman on eshu [14:13] backupppc [14:13] if yes that means ssh keys for every other machine [14:13] yup [14:13] we should check auth.log for remote logging from eshu since 13th [14:13] (with that particular key) [14:14] if none then we're lucky [14:14] ok starting that in 2 minutes [14:14] ok me too [14:14] zed: you don't happen to have a jabber id? [14:18] zed: 13th since when? [14:19] cause asa logins till 13. 01:02 backuppc [14:21] I am installing rkhunter and chkrootkit on all machines :þ [14:26] apollo13: that might be the last time it was backupe [14:26] d [14:26] jupp [14:26] btw why does lastlog show jan for lastlogin [14:27] auth.log (last): [14:27] Dec 13 01:02:56 asa sshd[12967]: pam_unix(sshd:session): session opened for user backuppc by (uid=0) [14:27] lastlog: [14:27] backuppc pts/2 eshu.ubuntu-eu.o Fri Jan 2 01:40:16 +0100 2009 [14:29] that's funny [14:30] aside from beeing funny, got an explanation? [14:31] ntpq -p ? [14:32] eshu.ubuntu-eu. .INIT. 16 u - 1024 0 0.000 0.000 0.000 [14:32] if you mean that [14:41] PID 5734(/proc/5734): not in readdir output [14:41] PID 5734: not in ps output [14:41] CWD 5734: /var/spool/nullmailer/queue [14:41] on dongo [14:41] nothing to worry about though I guess [14:53] zed: http://paste.pocoo.org/show/kaqvNz3rxUezh8RpwYay/ can you look over that? [14:54] oh and on lisa ntop is running :( [14:55] ok, if it's just rsync server that's file [14:55] it's the command backuppc should execute [14:56] jupp, at least I couldn't find any other commands around that [14:56] but might have overlooked something [14:56] for gu that's ok [14:56] (the packet sniffer is a false alert) [19:50] zed: we (ubuntu.ru) need to change something in DNS records but ehsu is out of order and I cannot use nsset. Is there other way?