Re: anonymous-ftp cracked

2001-09-20 Thread Karsten W. Rohrbach
P. U. (Uli) Kruppa([EMAIL PROTECTED])@2001.09.12 17:52:23 +: > > Hi, > > sorry for cross-mailing two lists! > > I am running -CURRENT (ok - though I do not know anything > about computers) and just found about about 624 MB trash in > my /var/ftp - this is my anonymous-ftp -directory. > It

Re: anonymous-ftp cracked

2001-09-16 Thread Mike Heffner
On 13-Sep-2001 Joe Greco wrote: |> Ted: I've been watching this one because I've HAD to allow uploads to |> incoming because of a need for such a place article submissions from |> our |> Tech mag website from 175+ countries. |> |> Your tips for monitoring (like the script for a daily listing of

Re: anonymous-ftp cracked

2001-09-13 Thread Joe Greco
> Ted: I've been watching this one because I've HAD to allow uploads to > incoming because of a need for such a place article submissions from our > Tech mag website from 175+ countries. > > Your tips for monitoring (like the script for a daily listing of the > directory) are so simple and obviou

Re: anonymous-ftp cracked

2001-09-13 Thread David O'Brien
On Thu, Sep 13, 2001 at 12:13:08PM -0300, Rik van Riel wrote: > On Wed, 12 Sep 2001, Ted Mittelstaedt wrote: > > > nobody should be running an open FTP server that allows > > uploading to anyone unless they are willing to take the time to > > monitor it > > Some ftp daemons have the option to au

RE: anonymous-ftp cracked

2001-09-13 Thread Rik van Riel
On Wed, 12 Sep 2001, Ted Mittelstaedt wrote: > nobody should be running an open FTP server that allows > uploading to anyone unless they are willing to take the time to > monitor it Some ftp daemons have the option to automatically email the admins every time a file gets uploaded. > 100MB is pl

Re: anonymous-ftp cracked

2001-09-13 Thread Sheldon Hearn
On Thu, 13 Sep 2001 09:08:17 EST, [EMAIL PROTECTED] wrote: > Your tips for monitoring (like the script for a daily listing of the > directory) are so simple and obvious it put a smile on my face. Thanks! LUV > this list! Since the damage of a cross-post is mostly done, I'm surprised nobody bot

RE: anonymous-ftp cracked

2001-09-13 Thread jacks
Ted: I've been watching this one because I've HAD to allow uploads to incoming because of a need for such a place article submissions from our Tech mag website from 175+ countries. Your tips for monitoring (like the script for a daily listing of the directory) are so simple and obvious it put a s

Re: anonymous-ftp cracked

2001-09-13 Thread Oliver Fromme
[broken quoting fixed] Kory Hamzeh <[EMAIL PROTECTED]> wrote: > Ted Mittelstaedt wrote: > > I've had a bit of experience with this sort of thing and I have > > to say that > > nobody should be running an open FTP server that allows uploading > > to anyone > > unless they are willing to ta

RE: anonymous-ftp cracked

2001-09-12 Thread Kory Hamzeh
Yup, I had some jerk constantly fill up the filesystem of the ftp directory until I finally disabled all uploads. The ethics of some people just amazes me. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Ted > Mittelstaedt > > >-Original Message

RE: anonymous-ftp cracked

2001-09-12 Thread Ted Mittelstaedt
>-Original Message- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED]]On Behalf Of Giorgos >Keramidas > >Another common thing done in writable incoming/ directories is to create a >file of fixed size, say 100 Mb, and use vnconfig to mount this file as the >incoming/ directory of an FTP s

Re: anonymous-ftp cracked

2001-09-12 Thread Giorgos Keramidas
From: P. U. (Uli) Kruppa <[EMAIL PROTECTED]> Subject: anonymous-ftp cracked Date: Wed, Sep 12, 2001 at 05:52:23PM +0200 > I am running -CURRENT (ok - though I do not know anything > about computers) Why are you running -CURRENT? Users that are running -CURRENT are expected to be able to track r

Re: anonymous-ftp cracked

2001-09-12 Thread Jim Bryant
This doesn't indicate that you were cracked if it was anonymous FTP. You may have been scanned for open ports, and it appears that they took advantage of your FTP being open. Set up logging via the inetd.conf line (man ftpd for options). Then you can at least use ipf or ipfw to ban the domain