From owner-freebsd-isp Thu Nov 29 5:36:38 2001 Delivered-To: freebsd-isp@freebsd.org Received: from server.fox56.tv (svcr-adsl-216-222-236-30.epix.net [216.222.236.30]) by hub.freebsd.org (Postfix) with ESMTP id 5B5EA37B432 for ; Thu, 29 Nov 2001 05:36:22 -0800 (PST) Received: from bill (bill.fox56.tv [192.168.1.101]) by server.fox56.tv (8.11.1/8.11.1) with SMTP id fATDhsX08245; Thu, 29 Nov 2001 08:44:07 -0500 (EST) (envelope-from billak@fox56.tv) Message-ID: <001e01c178da$4fecd7d0$6501a8c0@bill> From: "Bill A. K." To: "Ingrid Kast Fuller" , References: <9tsade$2rnn$1@FreeBSD.csie.NCTU.edu.tw> <3C05AD42.51EF62B7@cityscope.net> Subject: Re: Attack on server, need help ASAP Date: Thu, 29 Nov 2001 08:32:21 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org I think I have it straightened out, but thanks for offering. The server is running stable, with no evidence of intrusion, but I'm getting FreeBSD 4.4, and I'm going to install that as soon as I get it (I'll bring the server down for a few hours, probably at night and do a complete reformat). I'm running 4.2 now. This is my first time running FreeBSD as a server in an operating environment, and it is running very good. I have been messing with UNIX and FreeBSD for a while now, and I have enough knowledge to operate it, but sometimes I have to ask when a tricky situation comes up. Thanks again to you and everyone for all your help and offers of help. Bill billak@fox56.tv ----- Original Message ----- From: "Ingrid Kast Fuller" To: "Bill A. K." Sent: Wednesday, November 28, 2001 10:36 PM Subject: Re: Attack on server, need help ASAP > Bill do you still need help? If so, you are welcome to call me (if you > receive this tonight 11/28, I'll be up until 10:30pm at least.) > I'll answer the work number below until then. Or call me tomorrow and we can > talk. Maybe I can help in the future with FreeBSD issues. > > "Bill A. K." wrote:My server was just attacked.........someone tried logging > in telnet, and = > > > apparently shut down the telnet daemon from trying (over 400 = > > times)....theres NOTHING in the logs, the ips were on the screen, but = > > stupid me started typing stuff and now they're gone. Is there a way to = > > get back what was on the screen, like a history of stdout? Please, = > > someone help, asap, I would really appreciate it. > > > > Bill > > billak@fox56.tv > > - > > Ingrid Kast Fuller, President > CityScope Net > 3910 Fairmont Parkway #264 > Pasadena, TX 77504-3066 > Voice: 713-477-6161 > Fax: 713-477-3734 > > http://www.cityscope.net > > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message