/.iiim/auth/passwd on Solaris 8

Shay Weinstein <[email protected]>
Newsgroups gmane.comp.security.sun
Message-ID <[email protected]>
Hi all,

 I noticed a strange thing on several machines in my network and in a few home directories of users
 
 a directory .iiim/auth/ and a passwd file with an encrypted line.

 I saw a posting by John Bartoszewski <[email protected]> without answers:

> Date: Mon, 22 Oct 2001 23:34:07 -0600
> From: John Bartoszewski <[email protected]>
> To: [email protected]
> Subject: Usage of xiiimp.so.2
> Message-ID: <[email protected]>
>
>
>
>
>A few days ago I found a /.iiim/auth/passwd on one of my machines. 
> Thinking a break in I begin an investigation. 
> 
>
>
>I found that /usr/openwin/lib/locale/common/xiiimp.so.2 contains 
> references to this file. I then begin to see what uses this lib. 
> 
>
>
>As far as I an tell nothing does. 
> 
>
>
>Is there a program on a standard Solaris 8 install that uses xiiimp.so.2 
> (or ximlocal.so.2 which is a link to xiiimp.so.2)? 
>
>
>
>Is there any normal course of operation that would create this file? 
 


Thanks, 
 John 
 ---- 


 Any ideas what it is ? 


 Thanks, Shay Weinstein.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.