1The following is an example of setuids.d. Login events in particular can 2be seen, along with use of the "su" command. 3 4 # ./setuids.d 5 UID SUID PPID PID PCMD CMD 6 0 100 3037 3040 in.telnetd login -p -h mars -d /dev/pts/12 7 100 0 3040 3045 bash su - 8 0 102 3045 3051 sh su - fred 9 0 100 3055 3059 sshd /usr/lib/ssh/sshd 10 0 100 3065 3067 in.rlogind login -d /dev/pts/12 -r mars 11 0 100 3071 3073 in.rlogind login -d /dev/pts/12 -r mars 12 0 102 3078 3081 in.telnetd login -p -h mars -d /dev/pts/12 13 ^C 14 15The first line is a telnet login to the user brendan, UID 100. The parent 16command is "in.telnetd", the telnet daemon spawned by inetd, and the 17command that in.telnetd runs is "login". 18 19The second line shows UID 100 using the "su" command to become root. 20 21The third line has the root user using "su" to become fred, UID 102. 22 23The fourth line is an example of an ssh login. 24 25The fifth and sixth lines are examples of rsh and rlogin. 26 27The last line is another example of a telnet login for fred, UID 102. 28 29