<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Re: [luau] RE: Help with log analysis please</TITLE>
<META NAME="GENERATOR" CONTENT="StarOffice/5.2 (Linux)">
<META NAME="CREATED" CONTENT="20010730;18142200">
<META NAME="CHANGEDBY" CONTENT="Ben Beeson">
<META NAME="CHANGED" CONTENT="20010730;19264000">
</HEAD>
<BODY>
<P>Jon and others,</P>
<P><BR><BR>
</P>
<P> Yes I will most certainly do that!! My intent is not only to fix
my box, but also help the rest of the world keep their boxes up tight!!</P>
<P><BR><BR>
</P>
<P>Ben
</P>
<HR>
<P STYLE="margin-bottom: 0in">Original Message dated 7/30/01, 7:24:35
PM</P>
<P STYLE="margin-bottom: 0in">Author: "Jon Reynolds"
<proteon@gci.net></P>
<P STYLE="margin-bottom: 0in">Re: [luau] RE: Help with log analysis
please:</P>
<HR>
<P><BR><BR>
</P>
<P STYLE="margin-bottom: 0in"><FONT COLOR="#0000ff"><FONT FACE="Arial"><FONT SIZE=2>Ben,
even though I can't help you with this i would like to know the
resolution, so even if you do send it to someone on the list privately
will you change it up enough, to protect the innocent as Warren puts
it, to let me see how this is done also?</FONT></FONT></FONT></P>
<P STYLE="margin-bottom: 0in"> </P>
<P><FONT COLOR="#0000ff"><FONT FACE="Arial"><FONT SIZE=2>Jon</FONT></FONT></FONT></P>
<BLOCKQUOTE STYLE="text-align: left"><FONT FACE="Tahoma"><FONT SIZE=2>-----Original
Message-----<BR><B>From:</B> beesond001@hawaii.rr.com
[mailto:beesond001@hawaii.rr.com]<BR><B>Sent:</B> Monday, July 30, 2001
9:18 PM<BR><B>To:</B> Linux & Unix Advocates & Users<BR><B>Subject:</B>
[luau] Help with log analysis please</FONT></FONT></BLOCKQUOTE>
<BLOCKQUOTE>To all,
</BLOCKQUOTE>
<BLOCKQUOTE>As I was going through some of my logs today I noticed
something curious and as I began digging deeper, I began to get that
sinking feeling. Now, I am no expert, and I would sure appreciate it if
you guys could help me decipher this and tell me if my hunch is
correct. My hunch is that the following IP addresses have borrowed my
computer to try and visit a few web sites with... My other hunch is
that I should have caught it sooner, but that is a different story...</BLOCKQUOTE>
<BLOCKQUOTE>65.34.103.143 - - [30/Jul/2001:01:18:11 -1000] "GET
http://www.s3.com/ HTTP/1.1" 404 301</BLOCKQUOTE>
<BLOCKQUOTE>61.144.144.190 - - [19/Jul/2001:00:37:47 -1000] "GET
http://www.yahoo.com/ HTTP/1.1" 404 304</BLOCKQUOTE>
<BLOCKQUOTE>61.144.141.144 - - [20/Jul/2001:23:50:25 -1000] "GET
http://www.yahoo.com/ HTTP/1.1" 404 304
</BLOCKQUOTE>
<BLOCKQUOTE>128.132.37.68 - - [07/Jul/2001:06:42:54 -1000] "GET
http://www.mpogd.com/gotm/ HTTP/1.1" 404 309</BLOCKQUOTE>
<BLOCKQUOTE>Now just for grins I ran "last" and no one here
was logged in at these times.
</BLOCKQUOTE>
<BLOCKQUOTE>Now, I have also noticed a bunch of chicanery in my logs
this month, and it appears that my firewall has stopped all the stuff I
see in /var/log/messages. This stuff showed up elsewhere and now I am
beginning to feel that something a little more is up.
</BLOCKQUOTE>
<BLOCKQUOTE>What I would like is if someone could provide me some tips
for figuring out how these log entries appeared and what I should do to
plug those holes. I will be willing to share log files etc, but I don't
wish to post them to the list a) in their present form, and also b) to
save a little space on the server.
</BLOCKQUOTE>
<BLOCKQUOTE><BR><BR>
</BLOCKQUOTE>
<BLOCKQUOTE>Thanks in advance,</BLOCKQUOTE>
<BLOCKQUOTE>Ben
</BLOCKQUOTE>
<BLOCKQUOTE>--- You are currently subscribed to luau as:
proteon@gci.net To unsubscribe send a blank email to
$subst('Email.Unsub')</BLOCKQUOTE>
<P>---<BR>You are currently subscribed to luau as:
beesond001@hawaii.rr.com<BR>To unsubscribe send a blank email to
$subst('Email.Unsub')
</P>
</BODY>
</HTML>