[lug-nuts] Site cracked?

From: Brian Lavender (brian@brie.com)
Date: Mon Jan 10 2000 - 23:32:40 PST


I have been working on a Cobalt RAQ server and suddenly the thing is on
the fritz. I am able to ssh into it, but once I get on, bash forks on me
(at least that is the way it looks). Every command forks except for $
cd which allows me to change directories. Here is some sample output:

bash: fork: Try again
[admin admin]$ su
bash: fork: Try again
[admin admin]$ ls
bash: fork: Try again
[admin admin]$ pwd
/home/sites/home/users/admin
[admin admin]$ cd
[admin admin]$

as you can see both cd and pwd work. I have never encountered this problem.
The secure web server is still working, along with the administrative
server, but from the shell, it sure looks suspicious.

Does this look like a crack attack?

Here are the IP's:
209.235.50.96
209.235.50.95
209.235.50.94

Before these problems occured, the CPU usage and memory usage appeared erratic
from the web based admin tool.

brian

-- 
Brian Lavender
http://www.brie.com/brian/
****************************************************************************
* To UNSUBSCRIBE from the list, send a message with "unsubscribe lug-nuts"
* in the message body to majordomo@saclug.org. Please direct other
* questions, comments, or problems to lug-nuts-owner@saclug.org.



This archive was generated by hypermail 2b29 : Fri Feb 25 2000 - 14:29:10 PST