Re: [cobalt-security] gmon.out a security issue?

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Tuesday 02 April 2002 09:53 pm, Gerald Waugh wrote:
> -rw-r--r--  1 root  root  1095 Apr  1 14:04 /gmon.out
> I found one on one of my RaQ4s
> Notice the date Apr 1
> is this a fools file?
=================== M O R E =================
[root /]# ls -l -R | grep "Apr  1 14:"
-rw-r--r--   1 root   root          1095 Apr  1 14:04 gmon.out
-rw-------   1 root   root        32768 Apr  1 14:02 adm_ssl_scache.pag
drwxrwsr-x  19 nobody site2   1024 Apr  1 14:02 web
-rw-rw-r--   1 nobody   site2   9098 Apr  1 14:01 index.html

Apr  1 13:58:12 fsn3 sshd[1086]: Accepted password for admin from 
216.47.168.9 port 55842 ssh2
Apr  1 13:58:12 fsn3 PAM_pwdb[1086]: (sshd) session opened for user admin by 
(uid=0)
Apr  1 14:02:03 fsn3 sshd[1086]: Received disconnect from 216.47.168.9: 11: 
All open channels closed
Apr  1 14:02:03 fsn3 PAM_pwdb[1086]: (sshd) session closed for user admin

Now, admin logged onto the server at 13:58:12 on Apr 1st
and
logged out at 14:02:03 on Apr 1st
admin edited site2/index.html 

admin logged into the admin GUI at  14:02:56
[01/Apr/2002:14:02:57 -0500] "GET /cgi-bin/.cobalt/siteList/siteList.cgi
[01/Apr/2002:14:02:58 -0500] "GET /cgi-bin/.cobalt/alertSignal/alertSignal.cgi
[01/Apr/2002:14:03:01 -0500] "GET /cgi-bin/.cobalt/siteList/siteList.cgi
[01/Apr/2002:14:03:02 -0500] "GET /cgi-bin/.cobalt/alertSignal/alertSignal.cgi
[01/Apr/2002:14:03:20 -0500] "GET/cgi-bin/.cobalt/alert/alert.cgi
[01/Apr/2002:14:03:23 -0500] "GET /cgi-bin/.cobalt/alertSignal/alertSignal.cgi
[01/Apr/2002:14:03:24 -0500] "GET /cgi-bin/.cobalt/alert/alert.cgi
[01/Apr/2002:14:03:28 -0500] "GET /cgi-bin/.cobalt/raidUsage/raidUsage.cgi
[01/Apr/2002:14:03:35 -0500] "GET /cgi-bin/.cobalt/alert/alert.cgi
[01/Apr/2002:14:03:44 -0500] "GET /cgi-bin/.cobalt/alertSignal/alertSignal.cgi
[01/Apr/2002:14:03:45 -0500] "GET /cgi-bin/.cobalt/siteList/siteList.cg
[01/Apr/2002:14:03:58 -0500] "GET /cgi-bin/.cobalt/alertSignal/alertSignal.cgi
[01/Apr/2002:14:03:58 -0500] "GET /cgi-bin/.cobalt/alert/alert.cgi
[01/Apr/2002:14:04:04 -0500] "GET /cgi-bin/.cobalt/alert/service.cgi
and logged out at  14:04:51

Maybe one of these cgi`s did it???

I can't find where anyone else was logged into this server at those times???

- 
Gerald Waugh : Registered Linux user # 255245
http://www.frontstreetnetworks.com
Front Street Networks LLC - ph. 203.785.0699
229 Front Street, Ste. #C, New Haven, CT, United States of America
10:08pm up 12 days, 6:33, 3 users, load average: 2.03, 1.77, 1.64