I just found the following doing ps -auxw:
root 10526 0.0 0.2 500 1052 ?? S 6:19PM 0:00.01 ftpd:
zeus.eanet.cz: [priv pre-auth] (ftpd)
_ftp 10361 0.0 0.2 504 924 ?? S 6:19PM 0:00.00 ftpd:
zeus.eanet.cz: connected: USER admin (ftpd)
root 27896 0.0 0.2 500 1052 ?? S 6:19PM 0:00.01 ftpd:
zeus.eanet.cz: [priv pre-auth] (ftpd)
_ftp 253 0.0 0.2 504 928 ?? S 6:19PM 0:00.00 ftpd:
zeus.eanet.cz: connected: USER admin (ftpd)
What should I make of this? I immediately killed ftpd. Is this a
successful break-in or just an attempt?
I will be carefully looking around the system right now.
Chris
