From owner-freebsd-isp Sat Nov 24 16:31:33 2001 Delivered-To: freebsd-isp@freebsd.org Received: from www.golsyd.net.au (golsyd.net.au [203.57.20.1]) by hub.freebsd.org (Postfix) with ESMTP id DE45137B416 for ; Sat, 24 Nov 2001 16:31:25 -0800 (PST) Received: from [144.137.126.12] by www.quake.com.au (NTMail 4.30.0012/AB6169.63.5724aadf) with ESMTP id wmsdaaaa for ; Sun, 25 Nov 2001 11:30:57 +1100 Message-ID: <3C003BEF.4080309@quake.com.au> Date: Sun, 25 Nov 2001 11:31:43 +1100 From: Kal Torak User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.5) Gecko/20011011 X-Accept-Language: en-us MIME-Version: 1.0 To: "Bill A. K." Cc: freebsd-isp@freebsd.org Subject: Re: Attack on server, need help ASAP References: <000a01c1751e$b4fe5500$6501a8c0@bill> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Bill A. K. wrote: > My server was just attacked.........someone tried logging in telnet, and > apparently shut down the telnet daemon from trying (over 400 > times)....theres NOTHING in the logs, the ips were on the screen, but > stupid me started typing stuff and now they're gone. Is there a way to > get back what was on the screen, like a history of stdout? Please, > someone help, asap, I would really appreciate it. These messages most probably were logged... Have a look in /var/log/messages /var/log/security etc... To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message