Subj : bbs shut down http log
To   : DieselMan
From : Angus Mcleod
Date : Mon Jun 27 2005 10:18 am

  Re: bbs shut down http log
  By: DieselMan to All on Mon Jun 27 2005 04:17:00

 > for you that know what you are looking for at approx 2:39 the system was hac
 > for lack of a better word or caused to crash by a buffer overload or whateve
 > I'm a mechanic not an computer expert at all. I assure you i am sober and
 > watched it with my own eyes

If this is happening, I'd packet-capture the external interface to disk, 
then the next time this occured, I'd filter the capture file and see if I 
could figure out how they were getting in.

You are posting HTTP activity logs, but the shutdown commands seem to be 
coming from the console.  Either someone is getting a shell on the box, or 
they have found a way to "push" console commands from the HTTP interface.

Do you have 'tcpdump' on your system?  And 'ethereal' too?  Do you know 
how to use them?  What distribution are you using again?  Are you using a 
pre-packaged Synchronet installation, or are you compiling from CVS?




---
 þ Synchronet þ Linus is a regular at The ANJO BBS.  No, Linus Brathwaite!

.