Of late, our company has been getting attacks from someone on the internet and this has led us to being black listed. The administrator thinks its through my machine that the attacker is gaining access. I use ubuntu 10.04.3 on a windows network. How can I tell if someone is broken on to my system. something else my machine is trying to override the domain controller. is it possible?
On a second thought, you can also look through /var/log/auth.log to see if someone's been naughty. There are several logs in the /var/log directory that are useful to see if someone is trying to access your machine. Try to look for ssh attempts in hours/times when you weren't the one initiating them. This is, of course, if the attack you are refering to is ssh attack. -FH