From owner-freebsd-questions Thu Jul 5 4:33:19 2001 Delivered-To: freebsd-questions@freebsd.org Received: from fisher.vip.uk.com (fisher.vip.uk.com [194.176.218.14]) by hub.freebsd.org (Postfix) with ESMTP id 1637437B407 for ; Thu, 5 Jul 2001 04:33:17 -0700 (PDT) (envelope-from rob@robhulme.com) Received: from modem-123-52-60-62.vip.uk.com ([62.60.52.123] helo=hal9001) by fisher.vip.uk.com with smtp (Exim 3.22 #1) id 15I7Nj-0006OS-00 for freebsd-questions@freebsd.org; Thu, 05 Jul 2001 12:33:15 +0100 From: "Rob" To: "Freebsd-Questions@Freebsd. Org" Subject: Is my FTP hacked? Date: Thu, 5 Jul 2001 12:35:07 +0100 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG I think someone may have hacked into my ftp... I've got this line in my /var/log/messages "Jul 5 10:03:50 www ftpd[8728]: /etc/pwd.db: No such file or directory"... is there any way I can see what account they logged in as and so on? or has something else happened? I've disabled FTP for the moment.... -------------------------------- http://www.robhulme.com http://www.christianunion.org.uk "May the forks be with us." - Blue Raja (Mystery Men) Everything you've learned in school as "obvious" becomes less and less obvious as you begin to study the universe. For example, there are no solids in the universe. There's not even a suggestion of a solid. There are no absolute continuums. There are no surfaces. There are no straight lines. ---- R. Buckminster Fuller To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message