[9811] in Hotline Meeting
someone unswitching rlogin
daemon@ATHENA.MIT.EDU (mosquito@Athena.MIT.EDU)
Tue Jul 21 15:09:32 1992
From: mosquito@Athena.MIT.EDU
Date: Tue, 21 Jul 92 15:09:12 -0400
To: hotline@Athena.MIT.EDU
Cc: bug-terminal-room@fenchurch.MIT.EDU
I noticed someone rlogined under me on jerry-pournelle (in the 38-344
cluster). I zwrote him asking what he was doing and he didn't
respond, so I blew him away. I access_off'ed, and made sure he didn't
have any leftover processes. He later logged in under me again, and I
started searching through files he may have changed. I discovered
this person had changed /etc/inetd.conf to unswitch ftp, telnet,
login, erlogin, kshell, klogin, eklogin, and rkinit.
His username is luigi, and was remotely logging in from IRWIN.MIT.EDU.
It appears he has been doing this for about a week now. More details
can be found in /mit/mosquito/luigi where I cut and pasted various
interesting pieces of data.
Kevin Iga
mosquito@athena
iga@fenchurch
