hi all,
I have a firewall on my FreeBSD machine. Someone must have taken it
down for testing or something because I just checked today, and realized
that it was disabled.
Checking the auth logs, attempts to login from overseas IP's, etc. have
been occuring for at least a week.
Two quick questions:
1) SSH, SMUX, CVSPSERVER, and MYSQL were open to the world for about a
week..... I've checked through the auth.log file, done a chkrootkit,
checked lastlogin, etc.... nothing seems out of the ordinary other than
unsuccessful attempts at random usernames, etc. Does anyone have any
other ideas on what I can check?
2) Is there a way to set pf to default to deny? That way, if I disable
it for testing, it wont kick my existing SSH session out (I'll have keep
state set), but it will DENY any new connections. I'd rather have to go
to the colo place cause I messed up then get something hacked because I
messed up.
Thanks!
-Matt
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
