From owner-freebsd-security Tue Jul 3 8:46:39 2001 Delivered-To: freebsd-security@freebsd.org Received: from shell.futuresouth.com (shell.futuresouth.com [198.78.58.28]) by hub.freebsd.org (Postfix) with ESMTP id 2C16D37B401 for ; Tue, 3 Jul 2001 08:46:33 -0700 (PDT) (envelope-from fullermd@futuresouth.com) Received: (from fullermd@localhost) by shell.futuresouth.com (8.11.1/8.11.1) id f63FkQ405319; Tue, 3 Jul 2001 10:46:26 -0500 (CDT) Date: Tue, 3 Jul 2001 10:46:26 -0500 From: "Matthew D. Fuller" To: Peter Pentchev Cc: Magdalinin Kirill , freebsd-security@FreeBSD.ORG Subject: Re: weird messages Message-ID: <20010703104625.D25927@futuresouth.com> References: <20010703184206.A76046@ringworld.oblivion.bg> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20010703184206.A76046@ringworld.oblivion.bg>; from roam@orbitel.bg on Tue, Jul 03, 2001 at 06:42:06PM +0300 X-OS: FreeBSD Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Tue, Jul 03, 2001 at 06:42:06PM +0300, a little birdie told me that Peter Pentchev remarked > On Tue, Jul 03, 2001 at 07:23:58PM +0400, Magdalinin Kirill wrote: > > > > Jun 29 19:43:34 myserver ftpd[4429]: /etc/pwd.db: > > No such file or directory > > Jun 30 15:12:12 myserver ftpd[4961]: /etc/pwd.db: > > No such file or directory > > If you allow anonymous user logins, or some of your users are > chroot'd during ftp logins, then this means that somebody > has logged in, has been successfully chroot'd, and has tried > to retrieve an /etc/pwd.db file from within a chroot environment, > where you have probably not put such a file :) To expand: It's most likely NOT someone trying to fetch it, it's ftpd trying to find it. Think uid -> username mappings in 'ls'. -- Matthew Fuller (MF4839) | fullermd@over-yonder.net Unix Systems Administrator | fullermd@futuresouth.com Specializing in FreeBSD | http://www.over-yonder.net/ "The only reason I'm burning my candle at both ends, is because I haven't figured out how to light the middle yet" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message