Email address obfuscation in effect -- please
click here to turn it off.
[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
On Sun, 8 Feb 2009, Chad Whiting wrote:
> I would like to know how the sysadmin found the change. If it was an
> addition to a script does he regularly open his scripts up to look for
> any changes? I would say most of the time when I write scripts that I do
> not check them evertime before I run them. Maybe if there was something
> glaringly obvious like a significant change in the size of the file or a
> change in owner etc...
I don't know how he found it -- they said he was "an engineer," IIRC. A
good strategy would be to look at the history file of the guy who
departed, unless he deleted it. If he deleted it, you know he was up to
something and then you'll be even more motivated to look deeper. Well, I
guess the history file also could be edited to throw you off, so you
should always look deeper. Look at cron jobs for anything that will be
executed automatically, then look at anything that is called from that
cron job. Look closest at things that were modified recently.
Mike
_______________________________________________
discussion mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/discussion
Home | FAQ | Server | Presentations | Mailing Lists/Archives | Member Tools | Links | Sponsors | Contact