/.iiim/auth/passwd on Solaris 8
Shay Weinstein <[email protected]>
| Newsgroups | gmane.comp.security.sun |
|---|---|
| Message-ID | <[email protected]> |
Hi all, I noticed a strange thing on several machines in my network and in a few home directories of users a directory .iiim/auth/ and a passwd file with an encrypted line. I saw a posting by John Bartoszewski <[email protected]> without answers: > Date: Mon, 22 Oct 2001 23:34:07 -0600 > From: John Bartoszewski <[email protected]> > To: [email protected] > Subject: Usage of xiiimp.so.2 > Message-ID: <[email protected]> > > > > >A few days ago I found a /.iiim/auth/passwd on one of my machines. > Thinking a break in I begin an investigation. > > > >I found that /usr/openwin/lib/locale/common/xiiimp.so.2 contains > references to this file. I then begin to see what uses this lib. > > > >As far as I an tell nothing does. > > > >Is there a program on a standard Solaris 8 install that uses xiiimp.so.2 > (or ximlocal.so.2 which is a link to xiiimp.so.2)? > > > >Is there any normal course of operation that would create this file? Thanks, John ---- Any ideas what it is ? Thanks, Shay Weinstein.