FW: SCO /tmp missing FW: Filepro-list Digest, Vol 132, Issue 24

[Larry Hoover]

On 1/28/2015 9:08 AM, Chris Henschen wrote:
>> On 1/27/2015 10:42 AM, filePro List wrote:
>>> Hi all,
>>> I have three customers using SCO Openserver 7 and filePro which are
>>> finding the /tmp directory completely deleted at random times.  One
>>> uses MOS, the other two have different filePro apps.  This just
>>> started in 2015 and happens randomly.  I checked the crontabs and
>>> /etc/rc2.d for scripts that may be causing this.  I am totally
>>> perplexed.  Anyone else having this problem?
>
> Commenting on the missing /tmp folder. This has recently come up in another
> mailing group with regards to OSR6.  In these cases it's appeared they've
> had a ssh hack into the system.  I'd suggest checking the system's
> /usr/adm/syslog to see if there's any suspicious login.  Also, it's been
> noted some have had their root password changed when this occurs.  I've also
> seen where lower pseudo get locked up so you can't log them in.  For these
> you can go into scoadmin  System->Terminal Manager->Examine an look at all
> the low numbered pseudo ttys.
>
> Chris
>
> _______________________________________________
> Filepro-list mailing list
> Filepro-list at lists.celestial.com
> Subscribe/Unsubscribe/Subscription Changes
> http://mailman.celestial.com/mailman/listinfo/filepro-list
>
>

In checking the logs, there are a lot of attempts to ssh in on all of 
these systems.  Does SCO have a utility to block IPs like Linux has with 
iptables?  Or hosts.allow and hosts.deny?  I can't seem to find any 
documentation about this.

-Larry