Re: [cobalt-users] Possible Hack inprogress.... Help

["Vic Chisnell" <vic@xxxxxxxxxxxxxxx>]

On 14 Sep 2000, at 21:04, Lennie Core wrote:

> I have a client that is apparently attempting to ftp download and 
> upload to their domain on my RAQ3..  Where can I find the 
> immediate ftp.log's ?  The logs on their domains are 5 days old.
> The access log shows nothing relative to ftp..
> 
> Kind asistance appreciated..
> 
> Lennie Core

the way I watch my logs for ftp is telnet or ssh into the server

then 
su

then 
tail -f /var/log/messages

I just leave the window open to observe the log 24/7
shows the end of the access log as it is being written too

if in fact you do have someone attempting to hack your machine I would 
highly suggest portsentry, and ipchains.  

there are references to both in the user list database.

hope that helps,

Vic Chisnell