From: David Price (dprice@plugnpay.com)
Date: Thu May 01 2003 - 17:02:40 EDT
Thanks for all responses.
Everyone is unanimous so far is thinking it had to have been done by someone
and not something.
Possible a hacker.
To answers some of the questions asked.
I am the only SA. I was fast asleep at 6AM when this occurred.
The SU log shows no attempts to become root for several days prior.
If it was a hacker I suppose they could have edited this file.
Server has been up and running without a reboot for 91 days.
Time stamp on the netmasks file was last year.
Due to the location of the default gateway, changing the netmask had the
effect of isolating the server so if it was a hacker they would have gotten
booted off at the point the netmask was changed.
I am perplexed.
Thanks Again
> -----Original Message-----
> From: ALBERT.HUANG@jpmchase.com [mailto:ALBERT.HUANG@jpmchase.com]
> Sent: Thursday, May 01, 2003 4:22 PM
> To: dprice@plugnpay.com
> Subject: Re: Netmask changed on its own
>
>
>
> Did anyone reboot the machine?
> Also you can check the timestamp of the netmasks file.
>
>
>
>
>
>
>
> "David Price" <dprice@plugnpay.com>@sunmanagers.org on 05/01/2003 11:42:48
> AM
>
> Please respond to dprice@plugnpay.com
>
>
>
> Sent by: sunmanagers-bounces@sunmanagers.org
>
>
> To: <sunmanagers@sunmanagers.org>
> cc:
> Subject: Netmask changed on its own
>
>
> Hardware: Sun V120
> OS: Solaris 8
>
> The netmask on a V120 we maintain as a web server appears to have
> spontaneously changed its netmask this AM.
>
> Server did not reboot. No entries in messages.
>
> Has anyone had this happen to them before ?
>
> Thanks All
> _______________________________________________
> sunmanagers mailing list
> sunmanagers@sunmanagers.org
> http://www.sunmanagers.org/mailman/listinfo/sunmanagers
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers
This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 23:26:19 EDT