From owner-freebsd-security  Tue Jul  3  8:37:35 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ringworld.nanolink.com (ringworld.nanolink.com [195.24.48.13])
	by hub.freebsd.org (Postfix) with SMTP id 24C0237B408
	for <freebsd-security@freebsd.org>; Tue,  3 Jul 2001 08:37:32 -0700 (PDT)
	(envelope-from roam@orbitel.bg)
Received: (qmail 77082 invoked by uid 1000); 3 Jul 2001 15:42:06 -0000
Date: Tue, 3 Jul 2001 18:42:06 +0300
From: Peter Pentchev <roam@orbitel.bg>
To: Magdalinin Kirill <bsdforumen@hotmail.com>
Cc: freebsd-security@freebsd.org
Subject: Re: weird messages
Message-ID: <20010703184206.A76046@ringworld.oblivion.bg>
Mail-Followup-To: Magdalinin Kirill <bsdforumen@hotmail.com>,
	freebsd-security@freebsd.org
References: <F220rwiZ9rWjAKYVpMm00004d9a@hotmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <F220rwiZ9rWjAKYVpMm00004d9a@hotmail.com>; from bsdforumen@hotmail.com on Tue, Jul 03, 2001 at 07:23:58PM +0400
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Tue, Jul 03, 2001 at 07:23:58PM +0400, Magdalinin Kirill wrote:
> Hello,
> 
> can anyone explain what the following system
> console messages might mean:
> 
> Jun 29 19:43:34 myserver ftpd[4429]: /etc/pwd.db:
> No such file or directory
> Jun 30 15:12:12 myserver ftpd[4961]: /etc/pwd.db:
> No such file or directory
> 
> In the /var/log/ftpd.log they are among normal user commands
> (as they look to me)
> 
> The box is 4.1 release, some users can access it via ftp
> and have their own cgi-bin directories.

If you allow anonymous user logins, or some of your users are
chroot'd during ftp logins, then this means that somebody
has logged in, has been successfully chroot'd, and has tried
to retrieve an /etc/pwd.db file from within a chroot environment,
where you have probably not put such a file :)

G'luck,
Peter

-- 
I had to translate this sentence into English because I could not read the original Sanskrit.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message