Subject: Strange security output
To: None <port-amiga@netbsd.org>
From: Abhay Saxena <ark3@metaphasic.com>
List: port-amiga
Date: 02/29/2000 16:59:53
For the past two mornings I've gotten unusual output from the nightly
scripts that I can't explain. As far as I can tell, everything on the
system is working correctly. I have placed the script output onto two
web pages -- if you prefer, I can email it to you as well.

  http://metaphasic.dyndns.org/script.txt   yesterday morning
  http://metaphasic.dyndns.org/script2.txt  this morning

Basically, my question is: Why is this strange output happening, and how
do I make it stop?

Just to explain, the part about usr/local is normal -- I have made
/usr/local and /usr/pkg links to usr.local and usr.pkg on the machine's
/local partition. All the files and paths listed as being not found (the
long list of "No such file or directory") still exist. The Setuid
deletions section is also confusing in that all the files listed still
exist and have the same "ls -l" data (owner, group, mode, size, date) as
in the output.

Basically, the machine, IDC, only runs the Squid web proxy -- I rarely
use it for anything else. I don't run X, I don't read email on it, etc.
IDC sits on my private network -- its access to the 'net at large is via
NAT through a gateway box running FreeBSD connected to DSL. Although
there isn't much of a firewall in the way, since IDC doesn't have a
'net-at-large IP address, it's pretty hard to reach it from the outside
world. That, along with the obscurity principle of NetBSD/Amiga, is why
I don't suspect hackers to have caused this problem. As a side note, the
gateway box has not reported any security problems and appears to be
running just fine.

The machine is an Amiga 3000/25 with 16 megabytes of RAM and a
CyberVision 64/3D running NetBSD 1.4.1. As far as I can tell, nothing
changed two days ago to have caused any such problems to start
occurring. I didn't even access the machine two days ago except through
my usual Squid proxy usage.

  - Abhay

--
"Bother," said Pooh. "Eeyore, ready two photon torpedos and 
lock phasers on the Heffalump. Tigger, meet me in transporter 
room three. Piglet, you have the bridge."