Re: system breach

On Fri 2006-12-29 (17:25), Thomas Nystr?m wrote:
I just checked one of my servers and also found a /tmp/download
directory with the same files that you had.

I then compared the timestamp of /tmp/download with the timestamp
of the directories in /var/db/pkg: Same.

My conclusion is that during a portupgrade these files were written
there, directly or indirectly by portupgrade or the port itself.

oh. ok. well even though that's weird behaviour from a package it's
more plausible since i haven't found anything else suspicious. are
the timestamps exactly the same? i have 4 packages that're 20 minutes
different. which of yours are the same? or was that for all files.
(since i'd like to try an reproduce it).
_______________________________________________
freebsd-stable@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@xxxxxxxxxxx"