similar to: Hacked?

Hi, I have a 4.9-STABLE FreeBSD box apparently hacked! Yesterday I ran chkrootkit-0.41 and I don't like some of the outputs. Those are: chfn ... INFECTED chsh ... INFECTED date ... INFECTED ls ... INFECTED ps ... INFECTED But all the rest is NOT PROMISC, NOT INFECTED, NOTHING FOUND, NOTHING DELETED, or NOTHING DETECTED. I know by the FreeBSD-Security archives that

----- Original Message ----- From: "Ivan Voras" <ivoras@freebsd.org> >> The machine is running with ULE on 7.0 as mention using an Areca 1220 >> controller over 8 disks in RAID 6 + Hotspare. > > I'd suggest you first try to reproduce the stall without ULE, while > keeping all other parameters exactly the same. Ok tried with an updated 7 world / kernel as

G''Day Folks, I''ve finally typed up my classic DTrace demo, which I use to introduce people to DTrace (I delivered this at SOSUG#1), http://www.brendangregg.com/DTrace/dtracevstruss.html Here I create a fault and show the difficulty in analysing it using previous tools. Then I compare the impact of analysing the problem using both DTrace and truss. DTrace wins (a lot!).

I am still unable to get the following command to work correctly. The x's replace the correct entry obviously. smbclient -Lboss -Uxxxxxx%xxxxxxxx I decided to run the command as root preceeded by 'truss' so I could generate a debug output. This is the output from the command without 'truss' Domain=[BOSS] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager] Sharename

I am running a very simple multithreaded program (TestThread.C) which calls gethostbyname_r in several threads. My analysis of this program with both truss and DTrace suggest that is has a small leak. However, if I alter the program to have many more threads and run for a lot longer it never runs out of memory and does not carry on growing. Can anybody explain what I am missing in my analysis or

Hi, i am experiencing a problem with ssh 3.0.2.p1 running on Solaris 2.8. Everything works fine with local users (i.e. with local passwd and shadow entries). With LDAP authenticated users, i obtain: treno at tao[!] -> ssh -v Segmentation Fault (core dumped) The probem is the same with 2.x releases. Thank you, Roberto Bertucci

On my solaris 2.6 box, I get ssh moni ld.so.1: ssh: fatal: libz.so: open failed: No such file or directory Killed while as root, I have no problem. Note that echo $LD_LIBRARY_PATH /space/local/lib:/usr/local/lib:/usr/openwin/lib:/usr/lib:/opt/x11r5/lib ls -l /space/local/lib/libz.* -rwxr-xr-x 1 wierdlm faculty 70488 Mar 10 17:26 /space/local/lib/libz.a -rwxr-xr-x 1 bin bin

Hi all, I am installing a zone onto two different V445s running S10U4 and the zones are taking hours to install (about 1000 packages), that is, the problem is identical on both systems. A bit of trussing and dtracing has shown that the pkginstalls being run by the zoneadm install are making door_call calls to nscd that are taking very long, so far observed to be 5 to 40 seconds, but always in

Hi: I''m running Indiana (OpenSolaris developer preview) under parallels in OS X 10.5.1. I can consistently get Solaris to hang. Doing a dtrace -n pid\$target::malloc:entry''{@=count()}'' -c ls will consistently hang Solaris. Basically doing anything with PID provider with the -c option seems to hangs Solaris. Only way to recover is to stop and start Parallels desktop.

OK, so this may be a little off-topic, but here goes: The reason I switched to OpenSolaris was primarily to take advantage of ZFS''s features when storing my digital imaging collection. I switched from a pretty stock Linux setup, but it left me at one disadvantage. I had been using inotify under Linux to trigger a series of Ruby scripts that would do all the basic ingestion/setup for

Hi Samba world, Have been struggling with this for the past 10 days, we are running Samba 3.0.22 on VCS zone, we have end users saving files onto Samba mapped drive, and complained that it 5mins to save 300 files, now it takes 30 mins. There is recently a change in the topology. Before Enduser ----------- samba mapped -------------- server (local attached storage)

How do I find out why df -k is taking soo long to respond only sometimes? -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

We have been having a problem with sshd on our shell server. This has been happening since March 4, 2003 or before IIRC. Initially I thought the next OS upgrade, to 4.8 would fix this. I am accustomed to haveing little things go away in a month or two. I think we jumped to 4.7-STABLE on Feb 28, 2003. Some exploit fix wasn't being MFSd to RELENG_4_7 fast enough for my nerves (cvsd?). It

Hi Richard, Richard Robinson wrote: > I should add that I also used truss and saw the same ENOMEM error. I am on a 4Gb system with swap -l reporting > > swapfile dev swaplo blocks free > /dev/zvol/dsk/rpool/swap 181,1 8 4194296 4194296 > > and I was trying to follow the directions for increasing swap here: >

Hello, with OpenSSH_2.3.0p1 running in HP-UX 11.00 I noticed that the "SD commands" (like "swcopy") produce the following error when being logged in via SSH: ERROR: RPC exception: "Who are you failed (dce / rpc)" 11/29/00 11:20:18 MET Ideas? Regards, Ulrich P.S. Not subscribed to the list

On Apr 4, 2015, at 8:53 PM, Richard Flint <richard.flint at gmail.com> wrote: > I have used the truss command as directed. I have attached both the driver output and the last few sections of truss output leading to the hang. Both outputs end at the CTRL+C i pressed when i was forced to end the processes. > > Hope this is helpful. Please bear with me if i didn't run it with the

I have an Ultra 10 client running Sol10 U3 that has a zfs pool set up on the extra space of the internal ide disk. There''s just the one fs and it is shared with the sharenfs property. When this system reboots nfs/server ends up getting disabled and this is the error from the SMF logs: [ Apr 16 08:41:22 Executing start method ("/lib/svc/method/nfs-server start") ] [ Apr 16

I've gone back to 3.0.1 to try and get winbind to work with my Solaris 9 machine and NT4 domain. Everything works except user authentication. The wbinfo and getent commands do what they are supposed to. I've included a truss of 'su - ganguly' According to pamlog, the user 'ganguly' has been granted access but it is still hanging. How do I do a truss of a telnet login?

Hi Karl, I would like to send you the output, but after installing strace on my FreeBSD, i get the following: <p>/usr/local/bin/strace -o output -s 100 -f /usr/local/bin/ices /usr/local/etc/icecast/ices.xml strace: open("/proc/...", ...): No such file or directory trouble opening proc file Is there another way to send you a trace? <p><p><p>On Mon, 2003-08-11

I'm really scratching my head on this one. The server is running OpenSSH 5.1p1 on Solaris 9. The authentication is via PAM if that matters. # grep X11 sshd_config | sed '/^#/D' X11Forwarding yes X11DisplayOffset 10 X11UseLocalhost yes # Now I attach to my 'master' sshd and follow all children to look for any evidence of "DISPLAY": # truss -f -a -e -p 14923