From owner-freebsd-isp Sun Nov 25 5: 8:54 2001 Delivered-To: freebsd-isp@freebsd.org Received: from server.fox56.tv (svcr-adsl-199-224-119-238.epix.net [199.224.119.238]) by hub.freebsd.org (Postfix) with ESMTP id 055B737B405 for ; Sun, 25 Nov 2001 05:08:43 -0800 (PST) Received: from bill (bill.fox56.tv [192.168.1.101]) by server.fox56.tv (8.11.1/8.11.1) with SMTP id fAPDGJX01710; Sun, 25 Nov 2001 08:16:20 -0500 (EST) (envelope-from billak@fox56.tv) Message-ID: <001901c175b1$df3a36c0$6501a8c0@bill> From: "Bill A. K." To: Cc: References: Subject: Re: Attack on server, need help ASAP Date: Sun, 25 Nov 2001 08:05:34 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2505.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2505.0000 Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Nope, it isn't, I've been meaning to reinstall anyways to the latest FreeBSD...I guess this will just be more reason to do so. Thanks everybody, Bill billak@fox56.tv ----- Original Message ----- From: To: "Bill A. K." Cc: Sent: Sunday, November 25, 2001 7:35 AM Subject: Re: Attack on server, need help ASAP > > > On Sat, 24 Nov 2001, Bill A. K. wrote: > > > My server was just attacked.........someone tried logging in telnet, and apparently shut down the telnet daemon from trying (over 400 times)....theres NOTHING in the logs, the ips were on the screen, but stupid me started typing stuff and now they're gone. Is there a way to get back what was on the screen, like a history of stdout? Please, someone help, asap, I would really appreciate it. > > Not a solution to your problem but I may as well ask: > > 1.Why are you running telnet when there is ssh? > 2. Is your Freebsd machine patched against the telnetd exploit which was > relased some months ago? if nto start looking for signs of intrusion and > thhink of a reinstall. > > 3. Do a cvsup to the latest release or stable version of freeBSD. > > Noah. > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message