Iam confused. Last night i turned my redhat 7.2 system on as root and forgot to shutdown and today morning when i rebooted ,the system had to do root file system check because it was not properly shutdown(i turned the power off button)i have a differnet hostname (the new hostname is x1-6-00-e0-4c-03-2e-5e) was i hacked or is there any loss of data due to root file system check? how do i know if i my system was abused? BTW i was tweaking with postgresql server (port 5432) yesterday. could that be the reason?i run apache webserver and tomact server as root. and how do i change my hostname back to what i want.all other services like webserver are working fine.please suggest me what to do.
thanks in advance.

nah i doubt it... you're on ADSL i take it? try running ifconfig and i *think* that you'll see that your mac address is used as your hostname by the ISP, maybe it was their MAC, i can't remember... happened to me once i'm sure.

And wrt "how do I know if my system was abused?" search this forum you will, for "integrity check" "rootkit" "hacked" "chkrootkit" "sans" "cert". Weird it would be if no results turn up, a security forum, this being.

Hello acid_kewpie and thanks to both or you for replying.
Iam using at&t cable modem and not ADSL and i dont know if at&t uses the mac address as the hostname? any way iam at work so i will go home and check ifconfig to check my mac address.

acid_kewpie i use at&t cable modem(dhcp service) and as suggested by you , i executed ifconfig and my eth0(nic) HWaddr: 00-E0-4C-03-2E-5E and the hostname that i get (by hostname command) is x1-6-00-e0-4c-03-2e-5e. yes, i can see that part of my hostname has my mac address. and my /etc/hosts file has a line: 127.0.0.1 localhost.localdomain localhost
and /etc/sysconfig/network has NETWORKING=yes and HOSTNAME=localhost.localdomain. so what does this whole thing mean and why has my hostname suddenly changed? can i change my hostname by sethostname command and if i do that will it effect any of my netwoking services? thanks a lot and sorry for troubling with questions( im a newbie!!!!!!!!!!!)

i ran chkrootkit and found everything ok except these lines. How do i interpret them?

(1) Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/5.6.0/i386-linux/.packlist /usr/lib/mozilla/plugins/java2/bin/.java_wrapper


(2) eth0 is not promisc
(3) Checking `wted'... 1 deletion(s) between Mon Oct 7 08:32:31 2002 and Mon Oct 7 08:36:12 2002
1 deletion(s) between Thu Oct 10 16:10:56 2002 and Fri Oct 11 21:50:46 2002
nothing deleted
(4) Checking `z2'... user root deleted or never loged from lastlog!


thanks for your patience.

1. Dotfile from the looks of the name a false positive. Seen a lot on boxes with for instance Perl installed as well.
2. Your NIC is not listening to traffic not destined for itself. Good.
3. Wted. Tool to edit wtmp entries. Verify running "last -aix" to see all logins from the start of wtmp, and ac --complain to get overview of missing login records. Although missing login records itself don't necessarily mean you're box is cracked you should investigate manually.
4. If running "lastlog" manually shows root never logged in then you've got a problem. If you didn't install an integrity checker like Aide, Samhain or Tripwire (everyone should have one of those) you can still check (only currently installed files tho) running "rpm -Va" if the rpm database is not "edited" as well. But if you didn't install an integrity checker you'll never know.

Hmm. If you have more questions on security I would suggest opening a separate thread in the security foruma dn keep your network probs here unless theyre solved already.

After doing a fresh kerrnel compile, I had never actually logged in as root, I had only used 'su' to do root tasks, so lastlog was showing **Never logged in** for root. After actually logging in as user root from a console, lastlog now shows the time of this login and chkrootkit does not display this message anymore.