Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 18 Oct 2001 21:17:07 +0200
From:      Georgi Tyuliev <tyuliev@e20.physik.tu-muenchen.de>
To:        questions@FreeBSD.org
Subject:   77M    ./var/ftp/incoming/                    com2/tagged 4 Lhotse by  Xplosivo/filled by okunawa/tc2
Message-ID:  <3BCF2AB3.CB8F4D56@e20.physik.tu-muenchen.de>

next in thread | raw e-mail | index | archive | help
I am using FreeBSD-4.3 release and when I tried to make a telnet
I got a message telling  that the filesystem is full. It appears that
/var/ftp/incoming
directory is filled maliciously by some attacker. Unfortunately I can
not
remove these files/directories, their behavior is strange.
How one should proceed in such cases,
Best regards,
Dr. Georgi Tyuliev

Below is a part of the output from the commands:
"du -h"

497K    ./var/ftp/bin
4.0K    ./var/ftp/etc
1.0K    ./var/ftp/pub
1.0K    ./var/ftp/incoming/
1.0K    ./var/ftp/incoming/          com1
 77M    ./var/ftp/incoming/                    com2/tagged 4 Lhotse by
Xplosivo/filled by okunawa/tc2
 77M    ./var/ftp/incoming/                    com2/tagged 4 Lhotse by
Xplosivo/filled by okunawa
 77M    ./var/ftp/incoming/                    com2/tagged 4 Lhotse by
Xplosivo
 77M    ./var/ftp/incoming/                    com2
 77M    ./var/ftp/incoming
 78M    ./var/ftp
 84M    ./var
and
"ls -l"

drwxr-xr-x  2 ftp   operator  512 Oct 14 03:39
drwxr-xr-x  3 ftp   operator  512 Oct 14 13:37                     com2
drwxr-xr-x  2 ftp   operator  512 Oct 14 13:33           com1


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3BCF2AB3.CB8F4D56>