Bob, Run a chkrootkit utility and it will tell you a lot of info. It won't tell you everything but it may give you a higher level of confidence that it was not hacked, or of course give you areas of concern if it does find something. I agree, it looks suspicious at first glance. Some things look bad but aren't; for example it may come back and show a port open in the range of 32-thousand-something (32769?) - can't remember the exact one but further googling revealed that Fedora leaves one in that area open. When I ran it recently I was concerned about some things being open but I was happy to see that other than a very few other standard well known ports open for good reason, Fedora was pretty darn secure. Chkrootkit will do a lot other than ports, however. Check out <a href="http://freshmeat.net/projects/chkrootkit/">http://freshmeat.net/projects/chkrootkit/</a> Hope that helps some Marc <div>On 4/13/05, Bob Brennan <<a href="mailto:rbrennan96@gmail.com">rbrennan96@gmail.com</a>> wrote:<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> On 4/13/05, Kristina Clair <<a href="mailto:kclair@gmail.com">kclair@gmail.com</a>> wrote: > On 4/13/05, Bob Brennan <<a href="mailto:rbrennan96@gmail.com">rbrennan96@gmail.com</a>> wrote: > > On 4/13/05, Kristina Clair < <a href="mailto:kclair@gmail.com">kclair@gmail.com</a>> wrote: > > > Did you do a traceroute or any other network diagnostic to make sure > > > that you were actually able to reach the server? It sounds like a > > > networking problem... > > > > > > Kristina > > > > Hi Kristina - FTP and mailserver (the only other 2 open services) were > > responding quickly and correctly throughout the outage - all running > > on the same machine. > > > > Hmmm. I was confused about this point: > * all access_log and error_log for all sites - showed 5 users using > the sites at the time but nothing unusual > > Did you mean that 5 users were using the sites right before it became > inaccessible, or that there were people actually using the site when > you couldn't reach it? There were log entries on several of my virtual domains right up to the minute that the webserver became unresponsive - at least 5 separate IP addresses at the time. I noticed the problem when Squirrelmail timed out on a refresh. There are no log entries on any of the sites for the next 20 minutes. > Also, did you check all the domains that apache is configured to serve? Yes I checked all domains, including the IP address itself. Even "telnet <a href="http://myserver.net">myserver.net</a> 80" would not connect. "telnet <a href="http://myserver.net">myserver.net</a> 21" and 25 responded as expected. -- fedora-list mailing list <a href="mailto:fedora-list@redhat.com">fedora-list@redhat.com</a> To unsubscribe: <a href="http://www.redhat.com/mailman/listinfo/fedora-list"> http://www.redhat.com/mailman/listinfo/fedora-list</a> </blockquote></div>