From owner-freebsd-current Wed Sep 12 11: 3:21 2001 Delivered-To: freebsd-current@freebsd.org Received: from smtp012.mail.yahoo.com (smtp012.mail.yahoo.com [216.136.173.32]) by hub.freebsd.org (Postfix) with SMTP id 5393E37B40B for ; Wed, 12 Sep 2001 11:03:16 -0700 (PDT) Received: from mkc-65-31-219-45.kc.rr.com (HELO yahoo.com) (65.31.219.45) by smtp.mail.vip.sc5.yahoo.com with SMTP; 12 Sep 2001 18:03:16 -0000 X-Apparently-From: Message-ID: <3B9FA363.3020308@yahoo.com> Date: Wed, 12 Sep 2001 13:03:15 -0500 From: Jim Bryant Reply-To: kc5vdj@yahoo.com User-Agent: Mozilla/5.0 (X11; U; Linux i386; en-US; rv:0.9.2) Gecko/20010726 Netscape6/6.1 X-Accept-Language: en-us MIME-Version: 1.0 To: "P. U. (Uli) Kruppa" Cc: current@FreeBSD.ORG, freebsd-questions@FreeBSD.ORG Subject: Re: anonymous-ftp cracked References: <20010912174347.Q1009-100000@pukruppa.de> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG This doesn't indicate that you were cracked if it was anonymous FTP. You may have been scanned for open ports, and it appears that they took advantage of your FTP being open. Set up logging via the inetd.conf line (man ftpd for options). Then you can at least use ipf or ipfw to ban the domains that were involved. P. U. (Uli) Kruppa wrote: > Hi, > > sorry for cross-mailing two lists! > > I am running -CURRENT (ok - though I do not know anything > about computers) and just found about about 624 MB trash in > my /var/ftp - this is my anonymous-ftp -directory. > It was disposed in a sub-directory > ../incoming/tagged/byDj-krok . > > What can I do (besides deleting this stuff)? > > > Uli. jim -- ET has one helluva sense of humor! He's always anal-probing right-wing schizos! -------------------------------------------- POWER TO THE PEOPLE! _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message