From owner-freebsd-questions Tue Feb 12 8:32: 7 2002 Delivered-To: freebsd-questions@freebsd.org Received: from smtp-relay.sb.dsvr.net (sb1.ho.dsvr.net [212.69.222.8]) by hub.freebsd.org (Postfix) with ESMTP id 5C5CC37B41D for ; Tue, 12 Feb 2002 08:32:03 -0800 (PST) Received: from [212.69.208.113] (helo=stealthnet.co.uk) by smtp-relay.sb.dsvr.net with esmtp (Exim 3.11 #2) id 16aflu-0007Lj-00 for freebsd-questions@freebsd.org; Tue, 12 Feb 2002 16:27:10 +0000 Received: from JAMES (host213-121-66-201.surfport24.v21.co.uk [213.121.66.201]) by stealthnet.co.uk (8.11.6/8.11.6) with SMTP id g1CGRCU21367 for ; Tue, 12 Feb 2002 16:27:12 GMT From: "James Green" To: Subject: RE: Am I being hacked?! Strange connection attempts Date: Tue, 12 Feb 2002 16:27:32 -0000 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 In-Reply-To: <20020212170133.3bf6d5c9.johann@broadpark.no> Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG > During the last few weeks (months?) I've been getting a few > thousand of these into /var/log/messages: > > Feb 12 14:37:36 ninja ftpd[4697]: FTP LOGIN FAILED FROM > mp-217-217-113.daxnet.no, johann Someone is trying to connect to your ftp service and is being denied acceess. > And today, I've been getting about a few hundred of these > (although all on different ports): > > Feb 12 14:56:16 ninja /kernel: Connection attempt to TCP > 10.0.0.2:1433 from 61.153.3.67:2230 10.0.0.* is I think a private IP space for local LANs. Dunno about that. > Excactly what is going on? Well someone is probably portscanning your machine, finding interesting open ports like ftp and attempting to connect to them. You can log this sort of activity, check freshmeat.net for software and lots of sites for security advice. James Green To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message