RE: Need urgent help regarding security

2005-11-16 Thread Steve Bertrand
# ls -la /tmp also /var/tmp Indeed, many people would install with a /var partition, which would put /tmp under /var via symlink, but a good point. if you run awstats or phpBB - upgrade... Agreed, but even phpBB may not be the fault. Many problems with PHP come with the binary, not

RE: Need urgent help regarding security

2005-11-16 Thread Steve Bertrand
also /var/tmp Indeed, many people would install with a /var partition, which would put /tmp under /var via symlink, but a good point. My mistake...symlink was the wrong word to use here, for those who create a /var partition without physically making a /tmp partition.

RE: Need urgent help regarding security

2005-11-16 Thread Steve Bertrand
- top lists nothing significant. 97% idle CPU Irrelavent, the process is probably idle right now. - w only shows myself and one other legit user logged in who is editing config files with vi Perhaps they aren't currently logged in. - last shows nothing but myself and that one other user

RE: Need urgent help regarding security

2005-11-16 Thread Mark Jayson Alvarez
First, I want to thank you all for replying. For now what I just did is to just pulled the utp cable from its ethernet port. Now, no one can access it. However I tried once to put it back and then the ircd connection went up silently. It is confirmed that we are running psybnc like what

RE: Need urgent help regarding security

2005-11-16 Thread Steve Bertrand
Now what I want to do is to just reinstall the whole operating system and secure it as possible as I can. Like someone told, its just a waste to try to track it down because the intruder might be located somewhere on the other side of the world. They are always on the other side of the

SMBFS Problem after Upgrading to 6.0 stable

2005-11-16 Thread RdBSD
Dear all, Now i've been upgrading my system to 6.0 stable. But i have a little problem with smbfs in freebsd that i can't mount our windows server from my bsd box. Here are log file say : [EMAIL PROTECTED]: mount_smbfs -I 192.168.0.3 //[EMAIL PROTECTED]/misc$ /mnt/workgroup/ Password:

Re: Need urgent help regarding security

2005-11-16 Thread David Kirchner
On 11/16/05, Mark Kane [EMAIL PROTECTED] wrote: I also see a psyBNC server listening on port 7978: server# sockstat -l4 | grep psybnc USER COMMANDPID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS wicked6 psybnc 15819 3 tcp4 *:7978*:* Funny thing is there

RE: Need urgent help regarding security

2005-11-16 Thread Mark Jayson Alvarez
Steve Bertrand [EMAIL PROTECTED] wrote: Now what I want to do is to just reinstall the whole operating system and secure it as possible as I can. Like someone told, its just a waste to try to track it down because the intruder might be located somewhere on the other side of the world.

Re: Installation of Freebsd on external hard drive

2005-11-16 Thread Eric Schuele
Marco Calviani wrote: Hi Eric and list, unfortunately my BIOS (of a Travelmate 8005) does not support boot from USB devices. I'll search for some other information that comes from multi-os users. I''m interested in the answer myself Did a little googling, found this (not encouraging) post

Re: Need urgent help regarding security

2005-11-16 Thread Will Maier
On Wed, Nov 16, 2005 at 09:51:08PM -0500, Steve Bertrand wrote: Most *((cr/h)ackers* (and I use that term VERY loosely (aka: script kiddies)) are interested in rooting a box, and setting up a storage/sharing area that is free to them. This may not be the case, but it's better to 'observe' your

Re: Need urgent help regarding security

2005-11-16 Thread Will Maier
On Wed, Nov 16, 2005 at 05:16:37PM -0800, Mark Jayson Alvarez wrote: Good Day! At first I thought I was confused, but then I realized that you had cross-posted your message to freebsd-security@ and [EMAIL PROTECTED] Please don't do this, as it fragments the discussion. Good luck. --

problems with hostap/bridge

2005-11-16 Thread r0ach
after reading the wireless section in the fbsd handbook and sam/loaders wireless article (http://www.freebsdmall.com/~loader/en_US.ISO8859-1/articles/wireless/article.html), ive still been unable to get a working access point network: {Internet} |

Re: Need urgent help regarding security

2005-11-16 Thread Mark Kane
Steve Bertrand wrote: - top lists nothing significant. 97% idle CPU Irrelavent, the process is probably idle right now. I understand, but I was trying to give you the results of the commands that you asked Mark Alvarez to run. - w only shows myself and one other legit user logged in who is

Re: Need urgent help regarding security

2005-11-16 Thread Chad Leigh -- Shire.Net LLC
On Nov 16, 2005, at 9:38 PM, Will Maier wrote: OP has some asset that is being threatened or diminished by this attack, be it his bandwith, CPU cycles, host/network integrity or self confidence. He needs to identify that asset and work quickly to protect it. In most cases, this will mean

Solution for retrieving data from hard disk.

2005-11-16 Thread Aman Yus
I can't mount my hard disk. There's a very very very valuable data inside (family video - holiday trip) that I must recover. Hope you guys can pour all the solutions which i will (surely) try. Zillions of thanks. ___ freebsd-questions@freebsd.org mailing

Re: Need urgent help regarding security

2005-11-16 Thread Mark Jayson Alvarez
Marco Wertejuk [EMAIL PROTECTED] wrote: try sockstat | grep 6667 to see which process is connecting to irc and try to see what this process is doing with lsof, but depending on what backdoor or rootkit is used, it's possible to see nothing because intelligent rootkits hide themself Ok done

Re: BSD 5.4 fs problem...

2005-11-16 Thread Dinesh Nair
On 11/17/05 10:36 xinyu zeng said the following: Hi, I have FreeBSD 5.4 installed. I found each time I use ports to install software it always hangs there (i have only SSH to connect it) and there is even no ICMP reply (with ping). are you sure that nothing is happenning ? some ports

Re: Need urgent help regarding security

2005-11-16 Thread Mark Kane
David Kirchner wrote: On 11/16/05, Mark Kane [EMAIL PROTECTED] wrote: I also see a psyBNC server listening on port 7978: server# sockstat -l4 | grep psybnc USER COMMANDPID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS wicked6 psybnc 15819 3 tcp4 *:7978*:*

Re: strange msg lines..

2005-11-16 Thread Dinesh Nair
On 11/17/05 06:56 dick hoogendijk said the following: These are not normal requests to my apache server. But it seems to listen to them. Am I 'in danger?' apparently, the nameservers responsible for those domains are returning your IP address to a DNS query. all the sites seem to share the

Re: Solution for retrieving data from hard disk.

2005-11-16 Thread Dinesh Nair
On 11/17/05 13:26 Aman Yus said the following: I can't mount my hard disk. There's a very very very valuable data inside (family video - holiday trip) that I must recover. Hope you guys can pour all the solutions which i will (surely) try. Zillions of thanks. you may want to start by letting

Re: Intresting X Question...

2005-11-16 Thread Malcolm Kay
On Wed, 16 Nov 2005 05:47 pm, Eric Murphy wrote: Malcolm Kay wrote: On Wed, 16 Nov 2005 03:31 pm, Eric Murphy wrote: Maybe some body can explain this alittle better then my google searchs and other readings. My question is this: Lets say your installing BSD on some workstation, you dont

Re: BSD 5.4 fs problem...

2005-11-16 Thread xinyu zeng
I am using 'make install clean' command to get ports running. I have ever make some big ports (like postgresql-server-8.0) and system not hang immediately. I can see with top cpu more than 90% idle so I am wondering if this is HD failure. What I am concern is 'Is there any utilities can make a

<    1   2