From owner-freebsd-questions Mon Apr 30 13:51:16 2001 Delivered-To: freebsd-questions@freebsd.org Received: from falcon.scana.com (falcon.scana.com [161.156.101.7]) by hub.freebsd.org (Postfix) with ESMTP id 99DD837B422 for ; Mon, 30 Apr 2001 13:51:12 -0700 (PDT) (envelope-from MSILVER@scana.com) Received: by falcon.scana.com; id QAA24840; Mon, 30 Apr 2001 16:51:10 -0400 (EDT) Received: from maildmis.scana.com(161.156.248.91) by falcon.scana.com via smap (V5.5) id xma022439; Mon, 30 Apr 01 16:44:02 -0400 Received: from msg20.scana.com [161.156.248.91] by MSG20.SCANA.COM [161.156.248.91] (CMSPraetor 4.1.3395) with ESMTP id E944266E3DA711D595010002A51B97A8 for plus 1 more; Mon, 30 Apr 2001 16:34:07 -0400 Received: by maildmis.scana.com with Internet Mail Service (5.5.2653.19) id ; Mon, 30 Apr 2001 15:04:08 -0400 Message-ID: From: "SILVER, MICHAEL A" To: "'Zhihui Zhang'" , "'freebsd-questions@FreeBSD.ORG'" Subject: RE: incoming FTP troubles Date: Mon, 30 Apr 2001 13:37:14 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG It looks like some pirates uploaded some material to your ftp site for distribution. Apparently, they don't have a way to send this large amount of data to others, so they dump it on any ftp site they can find so their buddies can pick it up. Just delete it, and prevent anonymous from writing new files. I use to have anonymouse write access, but I use to have to monitor it constantly. After the last major FTP bug was found, I removed the write access all together. I also have a simple script that emails me anytime anyone starts up the FTP server. Nice on low traffic sites. ...Michael... -----Original Message----- From: owner-freebsd-questions@FreeBSD.ORG [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Zhihui Zhang Sent: Monday, April 30, 2001 1:29 PM To: freebsd-questions@FreeBSD.ORG Subject: incoming FTP troubles I created a anonymous FTP account but forgot to delete it during the weekend. Today I find the / is full and I check the files under /var/ftp: total 3 drwxrwxrwt 3 root operator 512 Apr 30 13:35 . drwxr-xr-x 7 14 operator 512 Apr 28 14:24 . TAGGED BY RROKDOKA dr-xr-xr-x 6 root operator 512 Apr 24 13:40 .. -rw-r--r-- 1 root operator 0 Apr 30 13:35 abc mercury# pwd; du /var/ftp 489 ./bin 4 ./etc 161 ./pub 1 ./incoming/. TAGGED BY RROKDOKA/1 1 ./incoming/. TAGGED BY RROKDOKA/2 1 ./incoming/. TAGGED BY RROKDOKA/3/1 1 ./incoming/. TAGGED BY RROKDOKA/3/2 1 ./incoming/. TAGGED BY RROKDOKA/3/3 1 ./incoming/. TAGGED BY RROKDOKA/3/4 16222 ./incoming/. TAGGED BY RROKDOKA/3/5/0426 - Matrik_X-part2.XXX.VCD-Cromix/CD1 16223 ./incoming/. TAGGED BY RROKDOKA/3/5/0426 - Matrik_X-part2.XXX.VCD-Cromix 16224 ./incoming/. TAGGED BY RROKDOKA/3/5 1 ./incoming/. TAGGED BY RROKDOKA/3/6 1 ./incoming/. TAGGED BY RROKDOKA/3/7 16231 ./incoming/. TAGGED BY RROKDOKA/3 1 ./incoming/. TAGGED BY RROKDOKA/4 1 ./incoming/. TAGGED BY RROKDOKA/5 16236 ./incoming/. TAGGED BY RROKDOKA 16238 ./incoming 16893 . What is exactly happening? How to get rid of this in the future? Thanks, -Zhihui To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message