<div><span class="gmail_quote">On 6/28/06, <b class="gmail_sendername">Tzafrir Cohen</b> <<a href="mailto:tzafrir.cohen@xorcom.com">tzafrir.cohen@xorcom.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">On Wed, Jun 28, 2006 at 04:39:29PM -0400, William Piper wrote:<br>> The same thing happened to me... I had to get a linux expert to take care of
<br>> it for me.<br>><br>> I believe the files were either "libpam" or "libss". They were telling<br>> asterisk to shutdown. I believe they deleted the files it that fixed it.<br><br>Is it following a glibc upgrade or something?
</blockquote>
<div> </div>
<div>I'm not sure what happened only that the answer had to do with those files. Hell, I don't even know what the files do, all I know is that the files were like a trojan and were masked as the name of a legitimate file. The affect was the same as you are having though.
</div><br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Asterisk is not linked with pam at all. libnss is the glibc name service<br>switch and has dynamically loading code.
<br><br>><br>> Tighten down your firewall.<br><br>Could you be more specific?</blockquote>
<div> </div>
<div>This problem happened more than once to us. I believe someone found a weekness in our system & found a way to access the server. We setup tight iptables and changed passwords and it hasn't happened again.</div>
<div> </div>
<div>I don't even know if this is the same thing, but it took about 7 hours of a linux guru to figure it out. I figure it couldn't hurt telling you about it.</div>
<div> </div>
<div>bp</div><br> </div><br>