[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Strange situation on /etc/profile



Greetings:

I have a very simple firewall machine running RH 7.3 + Monmotha firewall. The 
only way to login this machine is by ssh and this is restricted to the 
internal lan. Only open port is SMTP for incoming mail.

Suddenly, each time I log on via ssh I received the following message:

bash: /etc/profile: line 44: unexpected EOF while looking for matching `"'
bash: /etc/profile: line 50: syntax error: unexpected end of file

I checked the /etc/profile file and founded that the line 30 has been changed 
from:

USER="`id -un`"
to
USER=b`id -un`"

The file last modification date is "Mar 11 2002" (Firewall installation date). 
Aside from this, I have been unable to detect any other change to this file 
or to others firewall's files. There are no unexpected task running, xinetd 
is not installed and the firewall script is OK. Overall, the firewall is 
operating as expected.

This seems to me like the hard disk is having problems, but while I have seen 
corrupted files before (on other systems with nearly dead hard disks), what 
amuse me is the only one byte corruption. Is this possible?? 

Normally I will take this like a hard disk problem, but because this machine 
is the firewall, I have some security concern. Could it be that someone is 
tampering the firewall? Has anybody seen something like this?

TIA,
-- 
Carlos A. Siso





[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]