what's up with the Segmentation fault?

[McBoon]

when I use ps i get a "Segmentation fault"

Could that be a hack as someone doesn't want me to know what they are doing to my server or could that just be that the program broke and doesn't run anymore.
Either way, how do i fix that? or do i have to reinstall RH7.2?

[marvin]

You might have been hacked, and if you have been you should format and reinstall. even if you can fix the problems, you can't be 100% sure that you found and corrected everyting a cracker might have done.

My recommendation is that you take the box of the net if you have not done that already. Then download chkrootkit (http://freshmeat.net/projects/chkrootkit/?topic_id=43), and see if it finds anything.

You could also try running

rpm -Vf $(which ps)

and see if it reports any changed binaries. There was another thread about a segfaulting ps a while back, where this is described in more detail. You can find it here (http://www.linuxnewbie.org/cgi-bin/ubbcgi/ultimatebb.cgi?ubb=get_topic&f=4&t=015559). That computer turned out to have a rootkit installed and I guess it had some bug which caused the ps to segfault.

I recently read an interesting article about a Redhat 6.2 honeypot. You can find it
here (http://www.lucidic.net/whitepapers/sholcroft-4.1-2002.html). That will give you some info on how easy it is for a script kiddie to crack your box if you are running any unsecured/unpatched services.

Good luck

[mdwatts]

Probably download ckrootkit first before taking it off the net. ;)