Hey guys,
Had an interesting moment today. Running a Gentoo Linux system on a Sun Fire
v120, uptime of about 13 days, around 10 or 12 active users at any time.
One of my users reported that he was logged in and unable to view his
processes. I was logged in as root and also was unable to view his active
processes. The PID of his shell was not listed in /proc, nor was the PID of
any processes owned by any subsequent user.
Took the system down to init 1 and checked it out for any signs of foul
play, found none. No anomalous behavior in the logs, nothing weird that
grsec reported. Nothing in the NIDS logs of the attached system..
At this point I'm thinking it's more of a strange sshd bug (it's tracking
~sparc) as I logged in from the root console and was granted a PID and
visibility in 'w' output as well as 'who' output.
But still... anyone else seen this behavior?
--Andrew Ruef
--
gentoo-sparc@gentoo.org mailing list
Had an interesting moment today. Running a Gentoo Linux system on a Sun Fire
v120, uptime of about 13 days, around 10 or 12 active users at any time.
One of my users reported that he was logged in and unable to view his
processes. I was logged in as root and also was unable to view his active
processes. The PID of his shell was not listed in /proc, nor was the PID of
any processes owned by any subsequent user.
Took the system down to init 1 and checked it out for any signs of foul
play, found none. No anomalous behavior in the logs, nothing weird that
grsec reported. Nothing in the NIDS logs of the attached system..
At this point I'm thinking it's more of a strange sshd bug (it's tracking
~sparc) as I logged in from the root console and was granted a PID and
visibility in 'w' output as well as 'who' output.
But still... anyone else seen this behavior?
--Andrew Ruef
--
gentoo-sparc@gentoo.org mailing list