Re: I have been hacked (WAS: Have I been hacked or is nmap wrong?)

2006-01-18 Thread Will Maier
On Wed, Jan 18, 2006 at 05:38:50PM +0200, Kilian Hagemann wrote: > On Wednesday 18 January 2006 16:25, Will Maier pondered: > > On Wed, Jan 18, 2006 at 03:56:32PM +0200, Kilian Hagemann wrote: > > > I have never even heard of "frox" before, but after some > > > googling it turns out that it's a GPL

Re: I have been hacked (WAS: Have I been hacked or is nmap wrong?)

2006-01-18 Thread Kilian Hagemann
On Wednesday 18 January 2006 17:13, [EMAIL PROTECTED] pondered: > sendmail_enable="NONE" would do the same as all that other crap mentioned > i find it a waste of time trying to figure out how a hacker got in just > format the machine reinstall freebsd and secure the box up a bit and try > updating

Re: I have been hacked (WAS: Have I been hacked or is nmap wrong?)

2006-01-18 Thread Kilian Hagemann
On Wednesday 18 January 2006 16:25, Will Maier pondered: > On Wed, Jan 18, 2006 at 03:56:32PM +0200, Kilian Hagemann wrote: > > I have never even heard of "frox" before, but after some googling > > it turns out that it's a GPL'ed transparent ftp proxy... > > Where's it pointing? No idea, I only we

Re: I have been hacked (WAS: Have I been hacked or is nmap wrong?)

2006-01-18 Thread chris
sendmail_enable="NONE" would do the same as all that other crap mentioned i find it a waste of time trying to figure out how a hacker got in just format the machine reinstall freebsd and secure the box up a bit and try updating it when vulnerabilitie are out. And this shouldnt happen again >> Also

Re: I have been hacked (WAS: Have I been hacked or is nmap wrong?)

2006-01-18 Thread Crispy Beef
Also, I said smtp ports were open on the machines in question, I just verified that I can send emails via BOTH these systems even though no sendmail/exim/whatever was ever installed by me and sendmail_enable="None" on both. For what it's worth, to disable senmail on 5.0 and later, you need: s

Re: I have been hacked (WAS: Have I been hacked or is nmap wrong?)

2006-01-18 Thread Will Maier
On Wed, Jan 18, 2006 at 03:56:32PM +0200, Kilian Hagemann wrote: > I have never even heard of "frox" before, but after some googling > it turns out that it's a GPL'ed transparent ftp proxy... Where's it pointing? > Also, I said smtp ports were open on the machines in question, I > just verified t

I have been hacked (WAS: Have I been hacked or is nmap wrong?)

2006-01-18 Thread Kilian Hagemann
On Wednesday 18 January 2006 14:34, Ken Stevenson pondered: > Is there any chance you have a router that's forwarding the ports > in question to another computer? Not that I know of. The setup is quite simple: wireless ethernet(PPPoE) ethernet ISP<--->Modem<-->

Re: Have I been hacked or is nmap wrong?

2006-01-18 Thread Ken Stevenson
On Wed, Jan 18, 2006 at 11:29:38AM +0200, Kilian Hagemann wrote: > On Tuesday 17 January 2006 19:27, Micheal Patterson pondered: > > > The 1663 ports scanned but not shown below are in state: filtered) > > > PORT STATE SERVICE > > > 80/tcp open http > > > 554/tcp open rtsp > > > 1755/tcp o

Re: Have I been hacked or is nmap wrong?

2006-01-18 Thread Kilian Hagemann
On Tuesday 17 January 2006 19:27, Micheal Patterson pondered: > > The 1663 ports scanned but not shown below are in state: filtered) > > PORT STATE SERVICE > > 80/tcp open http > > 554/tcp open rtsp > > 1755/tcp open wms > > 5190/tcp open aol > > Kilian, what does a sockstat show you on

Re: Have I been hacked or is nmap wrong?

2006-01-17 Thread Micheal Patterson
- Original Message - From: "Kilian Hagemann" <[EMAIL PROTECTED]> To: Sent: Tuesday, January 17, 2006 11:07 AM Subject: Have I been hacked or is nmap wrong? Hi there, I'm managing two FreeBSD based gateways, one running 5.2.1-RELEASE and the other 5.3-STABLE,

Re: Have I been hacked or is nmap wrong?

2006-01-17 Thread Ken Stevenson
On Tue, Jan 17, 2006 at 07:07:17PM +0200, Kilian Hagemann wrote: > Hi there, > > I'm managing two FreeBSD based gateways, one running 5.2.1-RELEASE and the > other 5.3-STABLE, both not having been updated since I installed from ISO > images. They both have custom ipfw firewalls that are dropping

Have I been hacked or is nmap wrong?

2006-01-17 Thread Kilian Hagemann
Hi there, I'm managing two FreeBSD based gateways, one running 5.2.1-RELEASE and the other 5.3-STABLE, both not having been updated since I installed from ISO images. They both have custom ipfw firewalls that are dropping pretty much everything that's not supposed to come in. All was fine and