Intrusion

[jahall]

On Friday morning when I came to work, I found the following on my Linux server's screen 213.46.104.70. There was no other description and pressing control-C put me back to the login prompt.

This mmorning when I came to work, I had the following on my screen 202.212.22.16. Again pressing control-C put me back to the login prompt.

Looking at /var/log/messages, I find the following entries that look suspicious.

Oct 2 00:58:02 monea2 ftpd[3929]: ANONYMOUS FTP LOGIN FROM rd244.isis.de [195.198.124.244]

Oct 2 00:58:07 monea2 ftpd[3929]: FTP session closed

Oct 3 19:09:56 monea2 ftpd[10882]: ANONYMOUS FTP LOGIN FROM 202.212.22.10 [202.212.22.10]

The second login session lasts for 9 minutes, but I cannot find any information on what was uploaded, downloaded, etc.

I was able to get the times from the xferlog file.

Any suggestions what I should be looking for? Anonymous FTP access has now been disbaled.

Thanks in advance for your assistance.


Jay

[jahall]

OK. I think I might have found something. I was reading http://www.securityfocus.com/archive/91/75558
and found a problem similar to the one that I was originally having.

When this first started, all of my terminal types were set to dumb. I dismissed this as being from some software we had just installed to evaluate and simply added TERM="linux" to /etc/profile and went on.

Now, looking at the system I am having problems with I have two copies of login on the system. One is dated Sep 17 and the other is dated Oct 5. Both are the same length. The second copy of login is located in /bin/ /.

How long should /bin/login be? Is it possible to reinstall it from the RPMS that I have?

Thanks for your help.

Jay

[jahall]

Is there a way to look up IP addresses and determine who they belong to? I have the addresses of the person I believe cracked my server.

Thanks,

Jay

[toolie]

nslookup will translate ip -> human readable and vice versa.

nslookup 112.111.11.60 is how you would use it.

[jesterspet]

the host command works well too. Or if you really must http://www.samspade.org has tools you can use to find out this information.