From owner-freebsd-questions  Fri Feb 21  8:38:29 2003
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 83F9C37B401
	for <freebsd-questions@FreeBSD.ORG>; Fri, 21 Feb 2003 08:38:27 -0800 (PST)
Received: from pa-plum1b-166.pit.adelphia.net (pa-plum1b-13.pit.adelphia.net [24.53.161.13])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5C26143FA3
	for <freebsd-questions@FreeBSD.ORG>; Fri, 21 Feb 2003 08:38:26 -0800 (PST)
	(envelope-from wmoran@potentialtech.com)
Received: from potentialtech.com (working [172.16.0.95])
	by pa-plum1b-166.pit.adelphia.net (8.12.3/8.12.3) with ESMTP id h1LGcOrX007758;
	Fri, 21 Feb 2003 11:38:25 -0500 (EST)
	(envelope-from wmoran@potentialtech.com)
Message-ID: <3E565600.8050207@potentialtech.com>
Date: Fri, 21 Feb 2003 11:38:24 -0500
From: Bill Moran <wmoran@potentialtech.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.1) Gecko/20021127
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: "P.U.Kruppa" <root@pukruppa.de>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: Security Problem (?): strange logs
References: <20030221171200.N254@small.pukruppa.de>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

P. U. Kruppa wrote:
> Hi,
> 
> browsing my /var/log directory I found many files like these
> 
>               -----------------------------
> (...)
> log.?__???3

<snip>

> log.ibm all in one >
> 		----------------------------------
> 
> Most of them are empty, some of them contain messages like this
> 
> 		---------------------------------
> 
> (...)
> [2003/02/21 17:14:30, 0] smbd/service.c:make_connection(252)
>   gustavo (80.100.23.30) couldn't find service c
> 
>                ---------------------------------
> 
> Do I have any serious security problem, or are these some
> script kiddies ?

I would consider it a security problem if you don't know who those
Windows machines belong to.
Make sure SMB is firewalled off from the Internet, it will reduce
the risk considerably.

-- 
Bill Moran
Potential Technologies
http://www.potentialtech.com


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message