From owner-FreeBSD-users-jp@jp.freebsd.org  Fri Apr 16 01:46:33 1999
Received: (from daemon@localhost)
	by jaz.jp.freebsd.org (8.9.2+3.1W/8.7.3) id BAA18694;
	Fri, 16 Apr 1999 01:46:33 +0900 (JST)
	(envelope-from owner-FreeBSD-users-jp@jp.FreeBSD.org)
Received: from mogami.ann.tama.kawasaki.jp (IDENT:0@gw.ann.tama.kawasaki.jp [210.141.232.21])
	by jaz.jp.freebsd.org (8.9.2+3.1W/8.7.3) with ESMTP id BAA18688
	for <FreeBSD-users-jp@jp.freebsd.org>; Fri, 16 Apr 1999 01:46:32 +0900 (JST)
	(envelope-from zensyo@ann.tama.kawasaki.jp)
From: zensyo@ann.tama.kawasaki.jp
Received: from mailhost (1001@localhost [127.0.0.1])
	by mogami.ann.tama.kawasaki.jp (8.8.7/3.6W) with ESMTP id BAA05411
	for <FreeBSD-users-jp@jp.freebsd.org>; Fri, 16 Apr 1999 01:45:30 +0900 (JST)
Message-Id: <199904151645.BAA05411@mogami.ann.tama.kawasaki.jp>
To: FreeBSD-users-jp@jp.freebsd.org
In-Reply-To: Your message of "Thu, 15 Apr 1999 21:39:47 +0900"
References: <3715DE13.8CBD62E7@jaif.or.jp>
X-Mailer: Mew version 1.70 on Emacs 19.34.1 / Mule 2.3
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Date: Fri, 16 Apr 1999 01:45:30 +0900
Reply-To: FreeBSD-users-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+990405
X-Sequence: FreeBSD-users-jp 41314
Subject: [FreeBSD-users-jp 41314] Re: How do you do about illeagal access
 on your host?
Errors-To: owner-FreeBSD-users-jp@jp.freebsd.org
Sender: owner-FreeBSD-users-jp@jp.freebsd.org
X-Originator: zensyo@ann.tama.kawasaki.jp

$BNkLZ!w(BANN-NET$B$G$9!#(B

> $B$O$H$A$c$s!w%Q%9%3$G$9(B
> 
> Masakazu Yamada wrote:
> > $B%5!<%A%(%s%8%s$G8!:w$7$?$H$3$m!"<!$N$h$&$J$b$N$r8+$D$1$^$7$?!#(B
> > http://www.k-elektronik.org/arsip/eksploit/bsd/freebsd/fbsdrootkit.tar.gz
> > 
> > $BFbMF$H$7$F$O!"(B
> > 
> > This package includes the following:
> > 
> > chpass          Trojaned! User->r00t
> > inetd           Trojaned! Remote access

$B!ACfN,!A(B

> $B$3$s$J%D!<%k$,$"$C$F$$$$$b$N$J$N$+!"6/$$%7%g%C%/$r<u$1$^$7$?!#(B

$B$3$N<j$N%/%i%C%-%s%0%D!<%k$N(BURL$B$d!"<jK!$K$D$$$F=R$Y$?K\$,:G6aH/Gd$5$l(B
$B$F$$$F$V$C$?$^$2$^$7$?!#=q@t$K$$$C$Q$$CV$$$F$"$C$?$N$G$3$3$G$b>R2p$7$^(B
$B$9!#(B
$B=qL>(B $B%/%i%C%-%s%0BP:v%U%!%$%J%k%,%$%I(B
$BCx<T(B Anonymous
$BLuJT(B SE$BJT=8It(B
$B=PHG(B $B3t<02q<R(B $BfF1K<R(B
ISBN ISBN4-88135-732-8
$B2A3J(B 6,800$B1_(B
$BBS$NJ86g$K$h$k$H!V%M%C%H%o!<%/4IM}<T$OK\=q$r=OFI$9$Y$-$@!#$J$<$J$i!"B?(B
$B$/$NG.?4$J%/%i%C%+!<$,K\=q$r=OFI$7!"?7$?$KF@$?5;=Q$r$I$3$+$G;n$=$&$H$9(B
$B$k$+$i$@!#!D!W(B

> $B%7%g%C%/$r<u$1$F$P$+$j$bF~$i$l$J$$$N$G!"%j%b!<%H$J4D6-$G$N(BOS$B$N:F(B
> $B%$%s%9%H!<%k$b$^$^$J$i$J$$8=>u$G$O!"$H$j$"$($:<!$N$h$&$JBP=hNEK!$r(B
> $B$7$^$7$?!#(B

$BB>$NJ}$N%U%)%m!<$b$"$j$^$7$?$,!"$3$l$G$OBLL\$G$9!#:#7n9f$N(BUNIX
MAGAZINE$B$G;38}1Q$5$s$,%P%C%/%"%C%W$H%j%9%H%"$KIU$$$F$NCm0UE@$r=R$Y$F$$(B
$B$^$9!#(Brestore$B%W%m%0%i%`$KCV$-49$($i$l$?0Y$K!"2?EY(Brestore$B$7$F$b$=$N$D$I(B
$BN"8}$,:n$i$l$?$3$H$,$"$C$?$=$&$G$9!#(B

> (1) $B$3$N%[%9%H$OF1$8(BHDD$B$,(B2$BBfF1$89=@.$K$7$F$"$C$F!"(B2$BBfL\$N%7%9%F%`$O(B
>     $B$H$j$"$($:?/F~$5$l$k$b$N$NA0$N$b$N$J$N$G!"%3%^%s%I$r<B9T$9$k$H$-(B
>     $B$O$3$A$i$r;H$&!#(B

2$BBfL\$N%G%#%9%/$OEE8;$,@Z$i$l$F$$$?$N$G$9$+!)(B $B$=$&$G$J$1$l$P$3$A$i$b1x(B
$B@w$5$l$F$$$k2DG=@-$O$"$j$^$9$h$M!#(B

> $B5?Ld$=$N(B1
> cp$B$r<B9T$7$?:]!"$$$/$D$+$N%U%!%$%k$O(BText busy$B$H$J$C$F%3%T!<$G$-$J(B
> $B$+$C$?$,!"$3$l$i$r%3%T!<$9$k>l9g!"(Bkill$B$7$F$d$l$P$$$$$H;W$$$D$D$b(B
> $B<B:]$K(Bkill$B$7$F;Y>c$,$"$C$F$b:$$k$N$G!"$3$N(Bkill$B$H(Bcp$B$rF1;~$K<B9T$7$F(B
> $B:F5/F0$r?^$k$h$&$J(Bkill -HUP$BE*$JET9g$N$$$$J}K!$O$"$k$N$G$7$g$&$+!#(B

rootshell$B$,%$%s%9%H!<%k$5$l$F$$$k$H!"(Bps$B%3%^%s%I$bCV$-49$($i$l$F$$$F!"(B
$B?/F~<T$K$H$C$F8+$i$l$F$OET9g$N0-$$%W%m%;%9$OI=<($5$l$J$$$h$&$K$J$C$F$$(B
$B$k$H;W$$$^$9!#(B

> $B0J>e$r$d$j$^$7$?$,!"%j%b!<%H$G%j%V!<%H$5$;$k$H2?8N$+@N$+$i:F5/F0(B
> $B$7$J$$(B($B2hLL$r>C$7$F$$$k$+$i(B)$B$N$G!"<B:]$K$=$3$K9T$C$?$H$-$K:F5/F0(B
> $B$7$F$_$^$9!#(B

$B%j%b!<%H$+$i4IM}$9$k%^%7%s$,%j%V!<%H$,40A4$G$J$$$N$O7k9=CWL?E*$G$9$h$M!#(B
$B$=$l$+$i!"%3%s%=!<%k$r%7%j%"%k%3%s%=!<%k$K$7$F$*$$$F%7%j%"%k%]!<%H$r$I(B
$B$3$+$K7R$$$G$*$/$3$H$G!"$=$N!V$I$3$+!W7PM3$G%$%s%9%H!<%i!<$r;H$C$?%j%b!<(B
$B%H%$%s%9%H!<%k$b2DG=$G$9!#(B

$B%7%j%"%k%3%s%=!<%k$,;H$($J$$;~$O!D(B
 1. MFS-root$B$J%+!<%M%k$r:n$k(B
 2. PicoBSD$B$d(Bcrunchgen$B$r;H$C$F(B ssh$B$d%G%#%9%/%a%s%F%J%s%9MQ$N%3%^%s%I$,(B
    $BF~$C$?%U%!%$%k%7%9%F%`%$%a!<%8$r:n$k(B
    $B$3$l$K$O(B $B%M%C%H%o!<%/$N@_Dj$d(Bssh$B$G$N(Broot$B%m%0%$%s$N@_Dj$r$7$F$*$/(B
 3. 1$B$G:n$C$?%+!<%M%k$K(B2$B$N%$%a!<%8$rCmF~(B
 4. $B$3$N%+!<%M%k$r%j%b!<%H%^%7%s$K(BFTP$B$7$F4{B8$N%+!<%M%k$HF~$l49$($k(B
 5. $B:F5/F0$9$k!#(B
$B$3$l$G(Bmini root$BE*$J%/%j!<%s$J%7%9%F%`$G%j%b!<%H%^%7%s$r5/F0$G$-$k$H;W(B
$B$$$^$9!#$=$N>e$GI,MWItJ,$N%P%C%/%"%C%W$r<h$C$F<jF0:F%$%s%9%H!<%k$H$+!"(B
$B%P%C%/%"%C%W$+$i$NI|5l$J$I$r$9$k$HNI$$$H;W$$$^$9!#(B
$B7k9=0lH/>!Ii$J$N$G!"JL$N%^%7%s$G==J,$KN}=,$r@Q$s$G$+$i9T$J$&$3$H$r$*4+(B
$B$a$7$^$9!#(B

$B$9$:$-(B
