[wplug] Breakin attempts against the nobody account

Chris Ott cott at acclamation.com
Mon Mar 28 10:35:06 EST 2005


Drew from Zhrodague wrote:
> 
> 	Remember, logs tell all, if you make sure that you are logging. 

Also remember: this is *only* true if the break-in attempts were 
unsuccessful or you're logging to a remote machine. Typically, the first 
thing a cracker does after they gain access is cover their tracks by 
removing their login attempts from the log.

Incidently, I'm curious about whether the attempts on Bill's machine 
were from within the US. I recently had similar problems, myself, and 
all the addresses were foreign.

Chris




More information about the wplug mailing list