From owner-freebsd-questions Fri Feb 21 8:24:26 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E39F637B401 for ; Fri, 21 Feb 2003 08:24:24 -0800 (PST) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1155643FCB for ; Fri, 21 Feb 2003 08:24:24 -0800 (PST) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.12.6/8.12.6) id h1LGOL4m099829; Fri, 21 Feb 2003 10:24:21 -0600 (CST) (envelope-from dan) Date: Fri, 21 Feb 2003 10:24:21 -0600 From: Dan Nelson To: "P.U.Kruppa" Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Security Problem (?): strange logs Message-ID: <20030221162421.GA92688@dan.emsphone.com> References: <20030221171200.N254@small.pukruppa.de> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20030221171200.N254@small.pukruppa.de> X-OS: FreeBSD 5.0-CURRENT X-message-flag: Outlook Error User-Agent: Mutt/1.5.3i Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG In the last episode (Feb 21), P. U. Kruppa said: > browsing my /var/log directory I found many files like these > > ----------------------------- > (...) > log.─__ε┼═3 > log._τ___─ > log.a0035934 > log.aditi > log.alevrius_ > log.alevrius_.old > log.amanda > > Do I have any serious security problem, or are these some > script kiddies ? You porbably have a line line this in your smb.conf: log file = /var/log/log.%m which means that anyone connecting to your machine from a Windows machine through Network Neighborhood, even just browsing (i.e. not accessing any shares), gets a logfile created with the machinename as part of the name. -- Dan Nelson dnelson@allantgroup.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message