From owner-freebsd-questions@freebsd.org  Mon Oct  2 00:11:51 2017
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 75A9AE31BAE
 for <freebsd-questions@mailman.ysv.freebsd.org>;
 Mon,  2 Oct 2017 00:11:51 +0000 (UTC)
 (envelope-from freebsd@edvax.de)
Received: from mailrelay15.qsc.de (mailrelay15.qsc.de [212.99.187.254])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "*.antispameurope.com",
 Issuer "TeleSec ServerPass DE-2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id E11C473C55
 for <freebsd-questions@freebsd.org>; Mon,  2 Oct 2017 00:11:50 +0000 (UTC)
 (envelope-from freebsd@edvax.de)
Received: from mx01.qsc.de ([213.148.129.14]) by mailrelay15.qsc.de;
 Mon, 02 Oct 2017 02:11:42 +0200
Received: from r56.edvax.de (port-92-195-63-92.dynamic.qsc.de [92.195.63.92])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mx01.qsc.de (Postfix) with ESMTPS id 8CA193CBF9;
 Mon,  2 Oct 2017 02:11:41 +0200 (CEST)
Received: from r56.edvax.de (localhost [127.0.0.1])
 by r56.edvax.de (8.14.5/8.14.5) with SMTP id v920BeEI002430;
 Mon, 2 Oct 2017 02:11:40 +0200 (CEST)
 (envelope-from freebsd@edvax.de)
Date: Mon, 2 Oct 2017 02:11:40 +0200
From: Polytropon <freebsd@edvax.de>
To: The Doctor <doctor@doctor.nl2k.ab.ca>
Cc: freebsd-questions@freebsd.org
Subject: Re: Weird turnoff
Message-Id: <20171002021140.931f17de.freebsd@edvax.de>
In-Reply-To: <20171001232531.GA18260@doctor.nl2k.ab.ca>
References: <20171001232531.GA18260@doctor.nl2k.ab.ca>
Reply-To: Polytropon <freebsd@edvax.de>
Organization: EDVAX
X-Mailer: Sylpheed 3.1.1 (GTK+ 2.24.5; i386-portbld-freebsd8.2)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-cloud-security-sender: freebsd@edvax.de
X-cloud-security-recipient: freebsd-questions@freebsd.org
X-cloud-security-Virusscan: CLEAN
X-cloud-security-disclaimer: This E-Mail was scanned by E-Mailservice on
 mailrelay15.qsc.de with 1E9FF683619
X-cloud-security-connect: mx01.qsc.de[213.148.129.14], TLS=1, IP=213.148.129.14
X-cloud-security: scantime:.1334
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Oct 2017 00:11:51 -0000

On Sun, 1 Oct 2017 17:25:31 -0600, The Doctor wrote:
> Could be an attack.
> 
> All right.
> 
> As of this morning (3 p.m. UTC) my seconday FreeBSD 11.1 server
> has been going intreface down then up and then unable to route.
> 
> Rebooted this system 2 times today.
> 
> 
> What should I bee looking for?

Primarily the system's log files in /var/log: messages, auth.log,
security. Also check the output of the periodic scripts (mailed
to root or another user), do they contain hints to something that
looks suspicious (SUID changes, system file modifications, etc.)?



-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...