On Thursday 17 April 2008 19:45:26 Jim Perrin wrote:
Well, just stunnel by itself doesn't mean there's a breach, unless you never configured anything to use stunnel. You might want to do a little more digging on the system to confirm or disprove your suspicions. Have a look in places like /tmp or /var/tmp for hidden scripts or directories etc.
There are scripts that can help us detect this kind of things: rkhunter, chrootkit From Google: http://linuxhelp.blogspot.com/2006/12/various-ways-of-detecting-rootkits-in.... HTH,