hello everyone

Of late, our company has been getting attacks from someone on the internet and this has led us to being black listed. The administrator thinks its through my machine that the attacker is gaining access. I use ubuntu 10.04.3 on a windows network. How can I tell if someone is broken on to my system. something else my machine is trying to override the domain controller. is it possible?

6 Years
Discussion Span
Last Post by FelineHazard


What kind of attacks are we talking about here? Blacklisted from what?

If your client somehow is infected and it effects the entire network something is seriously wrong.


On a second thought, you can also look through /var/log/auth.log to see if someone's been naughty. There are several logs in the /var/log directory that are useful to see if someone is trying to access your machine. Try to look for ssh attempts in hours/times when you weren't the one initiating them.
This is, of course, if the attack you are refering to is ssh attack.

This question has already been answered. Start a new discussion instead.
Have something to contribute to this discussion? Please be thoughtful, detailed and courteous, and be sure to adhere to our posting rules.