OK,
I figured this out for myself. Wasn't sure which logfile to look at. Is
in /var/log/xferlog. So this is what an access attempt looks like.
Sorry for the noise.
Chris
Chris Bennett wrote:
I just found the following doing ps -auxw:
root 10526 0.0 0.2 500 1052 ?? S 6:19PM 0:00.01
ftpd: zeus.eanet.cz: [priv pre-auth] (ftpd)
_ftp 10361 0.0 0.2 504 924 ?? S 6:19PM 0:00.00
ftpd: zeus.eanet.cz: connected: USER admin (ftpd)
root 27896 0.0 0.2 500 1052 ?? S 6:19PM 0:00.01
ftpd: zeus.eanet.cz: [priv pre-auth] (ftpd)
_ftp 253 0.0 0.2 504 928 ?? S 6:19PM 0:00.00
ftpd: zeus.eanet.cz: connected: USER admin (ftpd)
What should I make of this? I immediately killed ftpd. Is this a
successful break-in or just an attempt?
I will be carefully looking around the system right now.
Chris
