From nobody@FreeBSD.org  Sat Apr 28 14:12:34 2007
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id DFD9A16A403
	for <freebsd-gnats-submit@FreeBSD.org>; Sat, 28 Apr 2007 14:12:34 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [69.147.83.33])
	by mx1.freebsd.org (Postfix) with ESMTP id CB76413C483
	for <freebsd-gnats-submit@FreeBSD.org>; Sat, 28 Apr 2007 14:12:34 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l3SECYPR085456
	for <freebsd-gnats-submit@FreeBSD.org>; Sat, 28 Apr 2007 14:12:34 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id l3SE7WWV079610;
	Sat, 28 Apr 2007 14:07:32 GMT
	(envelope-from nobody)
Message-Id: <200704281407.l3SE7WWV079610@www.freebsd.org>
Date: Sat, 28 Apr 2007 14:07:32 GMT
From: Maksym Kuvyklin<maximo4k@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: I have suspicion that somebudy use my server like zombie server.
X-Send-Pr-Version: www-3.0

>Number:         112207
>Category:       misc
>Synopsis:       I have suspicion that somebudy use my server like zombie server.
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Apr 28 14:20:04 GMT 2007
>Closed-Date:    Sat Apr 28 15:46:43 GMT 2007
>Last-Modified:  Sat Apr 28 15:46:43 GMT 2007
>Originator:     Maksym Kuvyklin
>Release:        FreeBSD 5.5 STABLE
>Organization:
Embassy of Ukraine
>Environment:
FreeBSD mail.ukremb.com 5.5-RELEASE FreeBSD 5.5-RELEASE #6: Mon Apr 23 14:41:21 EDT 2007     root@mail.ukremb.com:/usr/obj/usr/src/sys/MYKERNEL  i386
>Description:
Sorry for my pure English. I am new in this community.
I had detected that somebody tryed to penetrate via ssh into my server. When I had changed the port all this attempts were finished. Then server notified me about that somebody use my IP address and after that my network adapter had down. I had changed it to another one and the server had started work again. I have static IP address.But, now my connection is very slow. I have looked throught the logs and I had not found any tracks of penetration. Please, help me to solve this problem.
>How-To-Repeat:

>Fix:

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: linimon 
State-Changed-When: Sat Apr 28 15:45:40 UTC 2007 
State-Changed-Why:  
For questions like this that involve support issues, GNATS is not the 
right place to ask.  You will probably have better luck asking for help 
on one of the mailing lists such as freebsd-questions@FreeBSD.org.  Thanks. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=112207 
>Unformatted:
