關於Freenas 的內的紀錄訊息..[疑似被入侵否!?]

我公司的freenas server
是存放一些過期專案資料..

另外..
我偷偷的有 dl 一些 BT

今早進來看..發現..
bt下載頁面被清空..很怪..
查看 freenas 內的紀錄擋..

疑點1.
在命令列 自動紀錄下..出現一筆..我沒輸入過的指令 " mkdir -m 777 /dev/ad3p1/ "
而/dev/ad3p1/也多了資料夾..

疑點2.
發現 11/19日 00.45分..有大量的核心運作..很怪..
詳細的..我附加 SYSTEM.LOG 上來.
但是有幾筆..

Nov 19 00:45:21 freenas kernel: fdc0: <floppy drive controller> port 0x3f2-0x3f5,0x3f7 irq 6 drq 2 on acpi0
Nov 19 00:45:21 freenas kernel: fdc0: does not respond
Nov 19 00:45:21 freenas kernel: device_attach: fdc0 attach returned 6
Nov 19 00:45:21 freenas kernel: pmtimer0 on isa0
Nov 19 00:45:21 freenas kernel: orm0: <ISA Option ROM> at iomem 0xc0000-0xcb7ff on isa0
Nov 19 00:45:21 freenas kernel: sc0: <System console> at flags 0x100 on isa0
Nov 19 00:45:21 freenas kernel: sc0: VGA <16 virtual consoles, flags=0x300>
Nov 19 00:45:21 freenas kernel: vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Nov 19 00:45:21 freenas kernel: Timecounter "TSC" frequency 803612440 Hz quality 800
Nov 19 00:45:21 freenas kernel: Timecounters tick every 1.000 msec
Nov 19 00:45:21 freenas kernel: hptrr: no controller detected.
Nov 19 00:45:21 freenas kernel: md0: Preloaded image </mfsroot> 77594624 bytes at 0xc0c343f0
Nov 19 00:45:21 freenas kernel: ad0: 19092MB <Seagate ST320410A 3.64> at ata0-master UDMA66
Nov 19 00:45:21 freenas kernel: ad2: 152627MB <WDC WD1600AAJB-00PVA0 00.07H00> at ata1-master UDMA66
Nov 19 00:45:21 freenas kernel: ad3: 152627MB <WDC WD1600AAJB-00PVA0 00.07H00> at ata1-slave UDMA66
Nov 19 00:45:21 freenas kernel: Trying to mount root from ufs:/dev/md0
Nov 19 00:45:21 freenas kernel: WARNING: /mnt/ABC was not properly dismounted
Nov 19 00:45:21 freenas kernel: WARNING: /mnt/ABC was not properly dismounted
Nov 19 00:45:21 freenas kernel: WARNING: /mnt/CDF was not properly dismounted
Nov 19 00:45:21 freenas lighttpd[1313]: (log.c.97) server started
Nov 19 00:45:22 freenas smbd[1454]: [2008/11/19 00:45:22, 0] passdb/pdb_smbpasswd.c:startsmbfilepwent(241)
Nov 19 00:45:22 freenas smbd[1454]: startsmbfilepwent_internal: file /var/etc/private/smbpasswd did not exist. File successfully created.
Nov 19 00:45:23 freenas lighttpd[1590]: (log.c.97) server started
Nov 19 00:45:24 freenas login: login on ttyv0 as root


可以看到..
重新載掛了我的幾顆硬碟..
基本上..ad0 我本身沒有對他作 MNT..因為是系統碟

Nov 19 00:45:24 freenas login: login on ttyv0 as root
這行是啥意思..
是說 ttyv0 用 root 的權限登入嗎..

看使用者沒有這個人..


很怪..小弟是這種 freebsd 的新手使用者..
有哪為大大了解..
這是啥原因..
2008-11-19 12:52 發佈
另外..又看到幾行..
Nov 19 00:45:22 freenas smbd[1454]: [2008/11/19 00:45:22, 0] passdb/pdb_smbpasswd.c:startsmbfilepwent(241)

Nov 19 00:45:22 freenas smbd[1454]: startsmbfilepwent_internal: file /var/etc/private/smbpasswd did not exist. File successfully created.

查詢相對位置..
也看到有 檔案..
但是打不開..

我ssh / ftp 都沒打開說..
人家怎進來的..
用 telnet嗎..
還是用web..
ttyv0? 應該是你那台本機的螢幕, 不是透過網路進來的.

你要不要uptime看看機器是不是被重開過?
不然last看看之前有誰登入過..
內文搜尋
X
評分
評分
複製連結
Mobile01提醒您
您目前瀏覽的是行動版網頁
是否切換到電腦版網頁呢?