From owner-freebsd-questions  Wed Mar 20  9:57:23 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from mailserv.xpert.com (node-135.xpert.com [199.203.132.135])
	by hub.freebsd.org (Postfix) with ESMTP id 5EB5637B41D
	for <questions@freebsd.org>; Wed, 20 Mar 2002 09:57:17 -0800 (PST)
Received: by mailserv.xpert.com with Internet Mail Service (5.5.2650.21)
	id <G807K3KF>; Wed, 20 Mar 2002 19:57:21 +0200
Message-ID: <EB513E68D3F5D41191CA000255588101B438BE@mailserv.xpert.com>
From: Yonatan Bokovza <Yonatan@xpert.com>
To: 'Ken McGlothlen' <mcglk@artlogix.com>, questions@freebsd.org
Subject: RE: Crackers.
Date: Wed, 20 Mar 2002 19:57:20 +0200
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

> -----Original Message-----
> From: Ken McGlothlen [mailto:mcglk@artlogix.com]
> Sent: Wednesday, March 20, 2002 19:38
> To: questions@freebsd.org
> Subject: Crackers.
> 
> 
> I realize that I'm immune from this particular exploit:
> 
> Mar 19 06:27:08 ralf rpc.statd: invalid hostname to sm_stat: 
> ^X\M-w\M^?\M-?^X\M-w\M^?\M-?^Z\M-w\M^?\M-?^Z\M-w\M^?\M-?%8x%8x
> %8x%8x%8x%8x%8x%8x%8x%62716x%hn%51859x%hnM-^PM-^PM-^PM-^PM-^PM
> -^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^
> PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM
> -^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^
> PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM
> -^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^
> PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM
> -^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^
> PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM
> -^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^
> PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM
> -^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^
> PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM
> -^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^
> PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM
> -^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^P
> 
> I'd just like to know where these are coming from.  Is there 
> any way to get the
> IP addresses recorded in the logfiles other than packet filtering?

Not by default IIRC. You should use something extra
from the ports. I heartly suggest snort, but portsentry and
friends will do just as good.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message