From owner-freebsd-security  Thu Mar  6 06:30:54 1997
Return-Path: <owner-security>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id GAA20635
          for security-outgoing; Thu, 6 Mar 1997 06:30:54 -0800 (PST)
Received: from agora.rdrop.com (root@agora.rdrop.com [199.2.210.241])
          by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id GAA20527
          for <freebsd-security@freebsd.org>; Thu, 6 Mar 1997 06:29:31 -0800 (PST)
Received: from mail.fasts.com by agora.rdrop.com with smtp
	(Smail3.1.29.1 #17) id m0w2eAh-00091RC; Thu, 6 Mar 97 06:29 PST
Received: (qmail 1332 invoked from network); 6 Mar 1997 16:25:57 -0000
Received: from unknown (HELO cabby.fasts.com) (unknown)
  by unknown with SMTP; 6 Mar 1997 16:25:57 -0000
Message-ID: <331ED3ED.4950@fasts.com>
Date: Thu, 06 Mar 1997 16:25:49 +0200
From: Victor Rotanov <vitok@fasts.com>
Organization: FASTS Ltd.
X-Mailer: Mozilla 4.0b2 (Win95; I)
MIME-Version: 1.0
To: freebsd-security@freebsd.org
Subject: Hack attempts on our server.
X-Priority: 3 (Normal)
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


Hello.

It seems that our server has been hacked two days ago.

# last | grep 159.148.112.21
vitjok    ttyp6    159.148.112.21   Tue Mar  4 11:48 - 11:49  (00:00)
ftp       ftp      159.148.112.21   Tue Mar  4 10:58 - 11:04  (00:05)

Any ideas?

Thanks, bye.
vitjok