From owner-freebsd-questions@FreeBSD.ORG  Sat Dec 12 10:29:05 2009
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 4FABB1065672;
	Sat, 12 Dec 2009 10:29:05 +0000 (UTC) (envelope-from randy@psg.com)
Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36])
	by mx1.freebsd.org (Postfix) with ESMTP id 35B978FC0C;
	Sat, 12 Dec 2009 10:29:05 +0000 (UTC)
Received: from localhost ([127.0.0.1] helo=rmac.psg.com)
	by ran.psg.com with esmtp (Exim 4.70 (FreeBSD))
	(envelope-from <randy@psg.com>)
	id 1NJPDi-000GZx-PN; Sat, 12 Dec 2009 10:29:02 +0000
Received: from rmac.local.psg.com (localhost [127.0.0.1])
	by rmac.psg.com (Postfix) with ESMTP id 329ED2C9F882;
	Sat, 12 Dec 2009 19:29:02 +0900 (JST)
Date: Sat, 12 Dec 2009 19:29:01 +0900
Message-ID: <m2ein05vv6.wl%randy@psg.com>
From: Randy Bush <randy@psg.com>
To: $witch <a.spinella@rfc1925.net>
In-Reply-To: <op.u4rt7sclqr96hw@zeta>
References: <20091210144141.GB834@mech-cluster241.men.bris.ac.uk>
	<op.u4rt7sclqr96hw@zeta>
User-Agent: Wanderlust/2.15.5 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Cc: freebsd-current@freebsd.org, Anton Shterenlikht <mexas@bristol.ac.uk>,
	freebsd-questions@freebsd.org
Subject: Re: Root exploit for FreeBSD
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 12 Dec 2009 10:29:05 -0000

> but i look in syslogs of some FreeBSD internet server and there is a great  
> evidence that some "botnets" are (again) tryng simple combination of  
> uid/pwd.

/usr/ports/security/sshguard-*

randy