Some Linux security questions
Over the weekend, I had a running process, according to "ps aux", by USER root and the job was "sshd accepted". It was taking up ~50% of CPU usage, which was how I noticed it in the first place. What exactly is this process?
Greetings. I have a been running a REdhat 7.3 box since about 2002-ish, and while it's far...
I almost never remotely log in as root (the last time must be at least a month ago) and as such, promptly su'ed, end the process and changed root pbuttwords. I don't think I end anything of mine because all running tasks were unaffected, although since then I have never been able to get above 40-50% CPU utilisation with my own processes.
Where are the command and connection (external IP & MAC addresses, etc) logs for all users (including root) kept? Can they be altered? Do I need to worry about someone installing a rootkit or worse?
With reason of the enormous effort carried out to visit the Argentinean city of C—rdoba, to participate in the Meeting of MERCOSUR, in the closing of the Summit...
I seem to have two jobs that have been running for an unusually long never noticed system jobs running for so long before. Is this alright?
root 4357 13.0 0.0 171828 144 ? R Jul23 1483:31usr-X11R6-bin-X -nolisten tcp -br root 4492 0.1 0.0 76036 144 ? S Jul23 19:58opt-kde3-bin-kdmgreet
Con motivo del enorme esfuerzo realizado para visitar la ciudad argentina de C—rdoba, participar en la Reuni—n del MERCOSUR, en la clausura de la...
I will Google for how to disable remote root login and only allow root priviledges via su from a normal user account. In the meantime, is it possible to set up my SuSE 9.2 firewall so that it only grants root priviledges to certain MAC addresses (while allowing normal user accounts to log in from any external IP-MAC address).
Google search keywords, advice, etc. would be much appreciated.
Thanks.
Linux groups from Newsgroups