unix question: unknown user logged in? hacked?

[Manuel Arostegui Ramirez]

El Viernes, 20 de Abril de 2007 22:42, Mike Wright escribió:
> Hi all,
>
> There is a mystery user on a remote system that I can't identify.  I
> want to be sure that it's not an uninvited guest :(  If anybody is
> willing to help I'd be most aprpreciative.
>
> Running fc6, but I don't thinks it's relevant, although it may be.
>
> The box is at a remote location and I access it via ssh.  When I run
> "top" it shows 2 users, but when I run "who" it shows only one, me, from
> my remote location.
>
> At first I thought it might have been a left open login on one of the
> mingetty's so I disabled them all in inittab and changed runlevels from
> 3 to 4 and saw that all the mingetty's were gone (I think that should
> logout anybody on one of those), then returned to runlevel 3 and re-ran
> "top".  Still 2 users.
>
> I don't think it can be anybody left over from a previous runlevel 5.
>
> I ran "ps auxf" and went over it line by line and couldn't find any
> other bash sessions than my current remote login on pts/0.
>
> Anybody know how to identify the second user shown by top?
>
> I'm very paranoid about hackers/owners/skiddies and this definitely has
> my ears perked up.
>
> Thanks in advance for any tips or ideas,
> Mike Wright :m)

What lastlog says?
What about cat /var/log/secure?

-- 
Manuel Arostegui Ramirez.

Electronic Mail is not secure, may not be read every day, and should not
be used for urgent or sensitive issues.