[PLUG] How did they do this?

Galen Seitz galens at seitzassoc.com
Sat May 11 22:03:40 UTC 2002


Rich is running floppyfw, which doesn't even have rlogin and friends.  Unless
he has intentionally forwarded the rlogin port to an internal machine, 
which is unlikely, I don't think we are seeing an attempt on this port.
My guess is someone attempted to come in via ssh, perhaps using password
authentication.  Rich, could you post your log entry again and sshd version.
Also, you might want to feed it into google to see if you can find an 
explanation.

galen






More information about the PLUG mailing list