Gentoo Archives: gentoo-security

From: Fluff <fluff@×××××.se>
To: Venkat Manakkal <venkat@××××××××××.com>
Cc: gentoo-security@l.g.o
Subject: Re: [gentoo-security] new ssh worm?
Date: Tue, 27 Jul 2004 21:38:44
Message-Id: 1090964742.4106cd067bad7@epost.fluff.se
In Reply to: Re: [gentoo-security] new ssh worm? by Venkat Manakkal
1 Citerar Venkat Manakkal <venkat@××××××××××.com>:
2
3 > -----BEGIN PGP SIGNED MESSAGE-----
4 > Hash: SHA1
5 >
6 > On Tuesday 27 July 2004 17:01, Tobias Klausmann wrote:
7 > > Hi!
8 > >
9 > > While we're all puzzled... I'm puzzled that there actually *is* a
10 > > (disabled) guest account on my machine. I didn't create it, and I
11 > > don't know what it is intended for - so I renamed it, just to be
12 > > sure (and see stuff break).
13 > >
14 > > Anyone able to shed a light on this?
15 > >
16 > > Greets,
17 > > Tobias
18 >
19 > My guess is that installing samba creates it. Could someone verify?
20 >
21 > Cheers!
22 >
23 > - ---Venkat.
24 >
25
26 I have two different computers with Gentoo installed. Samba is installed on one
27 of them and both have a 'guest' user as UID 405.
28
29 Btw, I haven't had any mysterious connections to my sshd but the knock-thing
30 sounds interesting, I'm going to read that linuxjournal-thingy.
31
32 Cheers,
33
34 /Fluff
35
36
37 --
38 Fluff Abrahamsson
39 TIMELESS SOLUTIONS
40
41 T: 070 88 88 708
42 F: 070 88 88 701
43 E: fluff@×××××.se
44 #: 199919
45
46 [Proudly presents: hypodea.com and photochallenge.net]
47
48
49 ---
50 IMPORTANT NOTICE!
51
52 The contents of this email are confidential and are for the exclusive use of the
53 intended recipient(s). If you are not the intended recipient(s) please note that
54 any form of distribution, copying or use of this communication or the
55 information in it is strictly prohibited and may be unlawful. Please note that,
56 although this email has been virus-checked, neither Timeless Solutions HB nor
57 the sender accepts any responsibility for viruses and it is your responsibility
58 to scan the email and attachments (if any). If you believe you have received
59 this communication in error, please return it (with the title "received in
60 error") to the sender then delete the email and destroy any copies of it. We
61 would be grateful if you would also copy the communication to service@×××××.se
62
63 ----------------------------------------------------------------
64 This message was sent using IMP, the Internet Messaging Program.
65
66
67 --
68 gentoo-security@g.o mailing list

Replies

Subject Author
Re: [gentoo-security] new ssh worm? Stuart Haas <stuart@××××××××××.com>
Re: [gentoo-security] new ssh worm? Marc-Eric Dupuis <baal@×××××××××.net>