[NTLUG:Discuss] root can not edit hosts.deny file

[Kenneth Loafman]

m m wrote:
>>>>>
>>>>> On Tue, 17 Jun 2003, Kenneth Loafman wrote:
>>>>>>
>>>>>> Look primarily in the executables directories:
>>>>>>
>>>>>> /bin/*
>>>>>> /lib/*
>>>>>> /sbin/*
>>>>>> /usr/bin/*
>>>>>> /usr/lib/*
>>>>>> /usr/sbin/*
>>>>>> /usr/local/bin/*
>>>>>> /usr/local/lib/*
>>>>>> /usr/local/sbin/*
>>>>>>
>>>>>> in particular:
>>>>>>
>>>>>> ls
>>>>>> ps
>>>>>> find
>>>>>> top
>>>>>> gtop
>>>>>
> 
> what should I look for on these? I have check wiht ltattr, they all have 
> no ' i'  attribute been set.

You're probably OK then.  But run chkrootkit from 
http://www.chkrootkit.org just to be sure.

If you're really paranoid, re-install from scratch.

>>>>>> or, any file that shows process state (to keep the task hidden) 
>>>>>> or, any file that shows filesystem state (to keep the files hidden)

> could you give me an example?

Process state would be ps, top, gtop, lsof, and others.

Filesystem state would be ls, mount, df, du, and others.

...Ken