Help please

From: Ryan Hairyes (rhairyes@lee.k12.nc.us)
Date: 02/02/02 

From: Ryan Hairyes <rhairyes@lee.k12.nc.us>
Date: Sat,  2 Feb 2002 14:41:05 -0500
To: incidents@securityfocus.com

Hello all.

I am having some trouble and would like to know if someone can help me out.
Right now my mailserver (RedHat 7.2) is being used by unwanted guest to
attack adult sites via port 80 (Apache 1.3.20). When I run a netstat -an
on my system I can "see" them connected to my machine. I have snort and
have run that as well and sure enough they are there. It seems as though
they are using my apache to do brute force password cracking on these adult
sites. Thanks in advance.

Ryan

--------------------
Ryan Hairyes
Network Administrator -- Lee County School System
919.774.6226 x 1252
rhairyes@lee.k12.nc.us

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Loading