From owner-freebsd-security@FreeBSD.ORG  Wed Dec 22 20:44:41 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B55F916A4D1
	for <freebsd-security@freebsd.org>;
	Wed, 22 Dec 2004 20:44:41 +0000 (GMT)
Received: from cowbert.2y.net (d46h180.public.uconn.edu [137.99.46.180])
	by mx1.FreeBSD.org (Postfix) with SMTP id 3470943D45
	for <freebsd-security@freebsd.org>;
	Wed, 22 Dec 2004 20:44:41 +0000 (GMT)
	(envelope-from sirmoo@cowbert.net)
Received: (qmail 41199 invoked by uid 1001); 22 Dec 2004 20:44:40 -0000
Date: Wed, 22 Dec 2004 15:44:40 -0500
From: "Peter C. Lai" <sirmoo@cowbert.net>
To: Daniel Rudy <dr2867@pacbell.net>
Message-ID: <20041222204440.GH24545@cowbert.net>
References: <20041217120138.7A89116A4D2@hub.freebsd.org>
	<20041217145315.GB68582@wjv.com> <20041220095628.GA98945@augusta.de>
	<20041220171836.GC81898@wjv.com> <41C91696.6030507@pacbell.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <41C91696.6030507@pacbell.net>
User-Agent: Mutt/1.5.6i
cc: bv@wjv.com
cc: freebsd-security@freebsd.org
Subject: Re: Strange command histories in hacked shell history
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Dec 2004 20:44:41 -0000

On Tue, Dec 21, 2004 at 10:39:18PM -0800, Daniel Rudy wrote:
> Hey Bill, I have to agree with this.  But, if you don't mind my asking,
> why do you allow SSH access from all over the planet?  For a server, why
> not restrict the source IP to at least the same country that you are in?
> Or even to the IP address blocks of the few people who need access to it?
> 
> 
> -- 
> Daniel Rudy

This is beyond the scope of this list, but I thought that he was running
a shellbox where people could create users by themselves.

-- 
Peter C. Lai
University of Connecticut
Dept. of Molecular and Cell Biology
Yale University School of Medicine
SenseLab | Research Assistant
http://cowbert.2y.net/