From owner-freebsd-questions Sat Apr 20 17:23:06 1996 Return-Path: owner-questions Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id RAA10607 for questions-outgoing; Sat, 20 Apr 1996 17:23:06 -0700 (PDT) Received: from haven.uniserve.com (haven.uniserve.com [198.53.215.121]) by freefall.freebsd.org (8.7.3/8.7.3) with ESMTP id RAA10594 for ; Sat, 20 Apr 1996 17:22:59 -0700 (PDT) Received: by haven.uniserve.com id <31000-13775>; Sat, 20 Apr 1996 17:25:46 -0800 Date: Sat, 20 Apr 1996 17:25:43 -0700 (PDT) From: Tom Samplonius To: John-David Childs cc: freebsd-questions@freebsd.org Subject: Re: uucpd: passwd read Undefined error 0 In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-questions@freebsd.org X-Loop: FreeBSD.org Precedence: bulk On Sat, 20 Apr 1996, John-David Childs wrote: > I'm running 2.1.0-RELEASE on a remote machine and found the following > message this morning: > > /etc>grep uucp /var/log/messages > Apr 20 11:37:48 deimos uucpd[16164]: passwd read: Undefined error: 0 > Apr 20 11:53:55 deimos uucpd[16238]: passwd read: Undefined error: 0 > > Since I am not (yet) offering UUCP services on this particular box, I have > since disabled uucpd in /etc/inetd (stupid me, I forgot to check that > when I installed FreeBSD. However, I also noticed the following in my > /var/log/user.log > > Apr 20 11:38:11 > Apr 20 11:38:14 last message repeated 10 times > > /etc/syslog is set so that user.* goes to /var/log/user.log > > I am assuming that tried to get some sort > of password list from my FreeBSD box (waste of time, really, since there > are no user files on it ;-). Any clues appreciated. No. uucpd is only prompting for a password. Try it yourself by "telnet localhost uucp" and see what happens. Probably your machine was port scanned by someone at the other host. Most often this is some wannabe hacker with his/her first shell account and copy of Satan. Tom