[cobalt-users] Have I been hacked?

["George Ewing" <george@xxxxxxxxxxxx>]

I'm having major probs with my server, keeps dying.  Looked at this in my /var/log/messages file - anyone tell me what a 'lame
server' is?


Apr  4 18:55:30 ns named[376]: Lame server on '188.176/28.83.159.210.in-addr.arpa' (in '176/28.83.159.210.in-ad$
Apr  4 18:55:30 ns named[376]: Lame server on '188.176/28.83.159.210.in-addr.arpa' (in '176/28.83.159.210.in-ad$
Apr  4 19:00:03 ns proftpd[8473]: ns.top-graphics.co.uk (localhost[127.0.0.1]) - no such user 'anonymous'
Apr  4 19:00:03 ns proftpd[8473]: ns.top-graphics.co.uk (localhost[127.0.0.1]) - no such user 'anonymous'
Apr  4 19:00:03 ns proftpd[8473]: ns.top-graphics.co.uk (localhost[127.0.0.1]) - FTP session closed.
Apr  4 19:03:18 ns named[376]: Cleaned cache of 196 RRsets
Apr  4 19:03:18 ns named[376]: USAGE 986407398 986396598 CPU=1.89u/0.82s CHILDCPU=0u/0s
Apr  4 19:03:18 ns named[376]: NSTATS 986407398 986396598 A=745 CNAME=1 SOA=6 PTR=507 MX=215 AAAA=1 ANY=1015
Apr  4 19:03:18 ns named[376]: XSTATS 986407398 986396598 RR=1898 RNXD=171 RFwdR=1178 RDupR=2 RFail=0 RFErr=0 R$
Apr  4 19:03:35 ns named[376]: Response from unexpected source ([194.33.26.136].53)
Apr  4 19:04:56 ns named[376]: "teknophobe.co.uk IN NS" points to a CNAME (seawest2.seawest.net)
Apr  4 19:04:56 ns named[376]: "backwell.bristol.sch.uk IN MX" points to a CNAME (mail.backwell.bristol.sch.uk)
Apr  4 19:05:17 ns named[376]: "worldpop.com IN MX" points to a CNAME (backup.worldpop.com)
Apr  4 19:05:17 ns named[376]: Lame server on 'west-thames.ac.uk' (in 'west-thames.AC.uk'?): [193.63.106.103].5$
Apr  4 19:15:04 ns proftpd[9156]: ns.top-graphics.co.uk (localhost[127.0.0.1]) - no such user 'anonymous'
Apr  4 19:15:04 ns proftpd[9156]: ns.top-graphics.co.uk (localhost[127.0.0.1]) - no such user 'anonymous'
Apr  4 19:15:04 ns proftpd[9156]: ns.top-graphics.co.uk (localhost[127.0.0.1]) - FTP session closed.
Apr  4 19:21:22 ns named[376]: Lame server on '66.67.40.213.in-addr.arpa' (in '40.213.in-addr.arpa'?): [193.0.0$
Apr  4 19:23:07 ns sshd[9491]: Accepted password for admin from 62.31.233.33 port 1862
Apr  4 19:23:08 ns PAM_pwdb[9491]: (sshd) session opened for user admin by (uid=0)
Apr  4 19:23:16 ns PAM_pwdb[9527]: (su) session opened for user root by admin(uid=110)

George Ewing
Director
Top Host Ltd

Tel: 0870 7872193
Fax: 0870 7872194
email: george@xxxxxxxxxxxx