Check the history files for root and anyone who can su/sudo to root. If someone fat fingered roots account it will show here; if a hack then the history file may not be wiped. james ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Jan 07 2003 - 10:49:33 PST