hello,

i got the maps /sys and /srv in the rootdirectory. i don't know if i had them from the beginning, but a friend of mine (who knows quiet a lot about linux) told me they should not be in the rootdirectory and i maybe experiencing a rootkit attack.
can someone confirm that? or should i not be worried.

thx,
basilogics

Hi,
Just an observation, not really an answer: I'm using SUSE 9.2 where the /svr and /sys are listed under the "/" root directory. That's were all the important directories appear. The permissions are set such that only the "root user" can make changes those directories. Everybody else at most can only "read". Maybe your friend meant that they should not show up under "/root" user directory or should not have "root" as the owner. Even so, once someone has your root (user) password they can access it all.



There's always tomorrow