From owner-freebsd-questions Sat Feb 20 10: 3:25 1999 Delivered-To: freebsd-questions@freebsd.org Received: from hyperhost.net (ether.lightrealm.com [207.159.132.5]) by hub.freebsd.org (Postfix) with ESMTP id 8589611830 for ; Sat, 20 Feb 1999 10:03:20 -0800 (PST) (envelope-from patseal@hyperhost.net) Received: from port3.annex8.radix.net (port3.annex8.radix.net [205.252.108.3]) by hyperhost.net (8.8.5/8.8.5) with ESMTP id NAA22518; Sat, 20 Feb 1999 13:03:10 -0500 (EST) Date: Sat, 20 Feb 1999 13:03:04 -0500 (EST) From: Patrick Seal To: Jose Carlos da Silva Cc: freebsd-questions@FreeBSD.ORG Subject: Re: I've been hacked! In-Reply-To: <199902201754.MAA18691@hyperhost.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG I am using the TCP wrappers, have root login disabled, and am running a newly CVSUP'd 3.1-STABLE. What I what to know is how to contact his/her ISP. telnet stream tcp nowait root /usr/local/libexec/tcpd telnetd ------------------------------------ _____________________________________ Patrick Seal |"Microsoft isn't evil, they just make | really crappy operating systems." Hyperhost - http://www.hyperhost.net| -Linus Torvalds hosting and Design http://www.freebsd.org - http://www.linux.org On Sat, 20 Feb 1999, Jose Carlos da Silva wrote: > Patrick, Em 20 Feb 99, voce escreveu: > > > What can i do? > > Probably you're not in risk at all. Somebody tried to connect to your > FreeBSD machine using TELNET and he/she also tried to login as root. > > First of all, you should make sure that the TELNET channels are not > maked as secure int eh /etc/ttys file. Next you should consider using > TCP WRAPPERS or upgrading your FreeBSD instalation. Both solutions > will allow you to log the IP address of the attacker, so you can call > his/her service provider to complaint about the facts. > > Regards, > > o-----------------( Jose Carlos da Silva )-----------------o > | Administrador de Rede - WebMaster - jcds@brasmail.com.br | > | ALLNET! Provedor Internet http://www.allnet.com.br | > | Brasmail Internet Services http://www.brasmail.com.br | > | Central Brasileira de Listas http://www.listas.nu | > | Sao Paulo - SP - Brasil Fone: (011)3061-0088 | > o----------------------------------------------------------o > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message