tlug: /var/log/messages

[Tony Laszlo <laszlo@example.com>]

Hi Tlug, 

To this layman, it looks like I have been hacked into 
on a few occasions. I grepped around the log files 
and found this. 
My question: if this is an intruder, are there any 
easy ways to find out what s/he is or has been doing in 
there? 

Thanks. 


Jun 12 18:56:10 net identd[2517]: Returned: 61258 , 21 : NO-USER
Jun 12 18:57:44 net identd[2518]: Connection from 216.216.240.55
Jun 12 18:57:45 net identd[2518]: from: 216.216.240.55 ( 216.216.240.55 )
for: 6
1265, 21
Jun 12 18:57:45 net identd[2518]: Returned: 61265 , 21 : NO-USER
Jun 12 18:57:55 net identd[2519]: Connection from 216.216.240.55
Jun 12 18:57:55 net identd[2519]: from: 216.216.240.55 ( 216.216.240.55 )
for: 6
1268, 21
Jun 12 18:57:56 net identd[2519]: Returned: 61268 , 21 : NO-USER
Jun 12 18:58:10 net identd[2520]: Connection from 216.216.240.55
Jun 12 18:58:11 net identd[2520]: from: 216.216.240.55 ( 216.216.240.55 )
for: 6
1271, 21
Jun 12 18:58:11 net identd[2520]: Returned: 61271 , 21 : NO-USER

-------------------------------------------------------

Jun 30 02:14:22 net -- MARK --
Jun 30 02:15:13 net identd[11560]: Connection from external.barebones.com
Jun 30 02:15:13 net identd[11560]: from: 140.186.18.171 (
external.barebones.com
 ) for: 62289, 21
Jun 30 02:15:13 net identd[11560]: Returned: 62289 , 21 : NO-USER
Jun 30 02:34:22 net -- MARK --





-----------------------------------------------------------------------
Next Technical Meeting: July 8 (Sat)  13:30  Place: LinuxProbe Hall
Next Nomikai meeting: August 18 (Fri) 19:00  Place: TBD
-----------------------------------------------------------------------
more info: http://www.tlug.gr.jp        Sponsor: Global Online Japan