| View previous topic :: View next topic |
| Author |
Message |
Impalatore-polacco
Apprentice
Joined: 15 Apr 2007
Posts: 203
Location: Campogalliano - bell'ITALIA
|
 Posted: Mon Dec 03, 2007 11:41 pm Post subject: KRFB hacked !! [CLOSED] |
 |
|
Hy,
I've left the krfb session opened for one day...and when I back home I see someone is connected to my krfb server and when I've put the passwd to unlock the screensaver he disconnected...how I can see the IP of the latest connection, or who connected to my host apart me???!!!
PLZ HELP
_________________
Ci stanno osservando, ci sono i pipistrelli....ne hai presa troppa bello, ne hai presa troppa
Last edited by Impalatore-polacco on Mon Dec 10, 2007 12:52 pm; edited 1 time in total |
|
| Back to top |
|
 |
baeksu
l33t
Joined: 26 Sep 2004
Posts: 609
Location: Seoul, Korea
|
| Posted: Tue Dec 04, 2007 1:17 am Post subject: |
|
|
Assuming he hasn't tampered with /var/log/wtmp, you can get the list of all logins and outs (including the source ip address) with 'last'.
_________________
Gnome:
1. A legendary being.
2. A never ending quest to make unix friendly to people who don't want unix and excruciating for those that do. |
|
| Back to top |
|
|
Impalatore-polacco
Apprentice
Joined: 15 Apr 2007
Posts: 203
Location: Campogalliano - bell'ITALIA
|
| Posted: Tue Dec 04, 2007 8:40 am Post subject: |
|
|
Thx....the logins list remain also after a reboot?
_________________
Ci stanno osservando, ci sono i pipistrelli....ne hai presa troppa bello, ne hai presa troppa |
|
| Back to top |
|
|
bunder
Bodhisattva
Joined: 10 Apr 2004
Posts: 5947
|
| Posted: Tue Dec 04, 2007 1:00 pm Post subject: |
|
|
| Impalatore-polacco wrote: | | Thx....the logins list remain also after a reboot? |
the ones from last do, but i'm not sure if kde's remote desktop writes utmp/wtmp entries, as its only a vnc session attached to the current running desktop. 
since you said you had your screen locked, he couldn't have done anything. if you're really worried about someone gaining access to your box this way, you could always use iptables to allow connections only from certain network segments.
cheers
_________________
| Neddyseagoon wrote: | | The problem with leaving is that you can only do it once and it reduces your influence. |
banned from #gentoo since sept 2017 |
|
| Back to top |
|
|
Impalatore-polacco
Apprentice
Joined: 15 Apr 2007
Posts: 203
Location: Campogalliano - bell'ITALIA
|
| Posted: Tue Dec 04, 2007 1:57 pm Post subject: |
|
|
...mmmm, no etries for VNC 
_________________
Ci stanno osservando, ci sono i pipistrelli....ne hai presa troppa bello, ne hai presa troppa |
|
| Back to top |
|
|
|
Networking & Security
