ping: sendto: No buffer space available

Loz fbsd-q at bosh.org
Wed Jun 18 04:17:04 PDT 2003


* Jaime <jaime at snowmoon.com> [2003-06-18 00:49]:
> 	The clues to a crack are evident, too.  A process "/usr/sbin/nscd"
> is running on the box according to top and ps, but the file does not
> exist.  Further more, I never told such a process to execute.  Shortly
> after a reboot, a netstat command showed a connection to 37303 on a remote
> host.  I was the only person logged in and I did not initiate that
> connection.

Sounds familiar - a friend had a Linux box cracked over the weekend...
apparently russian script kiddies using a php gallery exploit. Sorry I
don't have any more details, but I do know that in his case at least
nothing else was compromised. He found all the answers he needed on
Google.

good luck, 
/loz.




More information about the freebsd-questions mailing list