February 19, 201313 yr Does this mean someone has logged into my unraid console? Feb 17 15:28:08 Tower in.telnetd[5163]: connect from 192.168.1.65 (192.168.1.65) (Routine) Feb 17 15:28:08 Tower vsftpd[5162]: connect from 192.168.1.65 (192.168.1.65) (Routine) Feb 17 15:28:08 Tower vsftpd: Sun Feb 17 15:28:08 2013 [pid 5164] CONNECT: Client "192.168.1.65" Feb 17 15:28:08 Tower telnetd[5163]: ttloop: peer died: EOF (Logins) Feb 17 15:28:10 Tower unmenu[1632]: bad method - 2938471 158449437 1291349784 100073890 621872 35005728 285032400 31484420 0 31541360 1316444802938471-^M Feb 18 22:27:06 Tower emhttp: disk_temperature: ioctl (smart_enable): Invalid argument (Other emhttp) Feb 18 22:27:06 Tower last message repeated 2 times Feb 19 03:52:45 Tower kernel: Hangcheck: hangcheck value past margin! on my version 4.7 machine ... 1.65 is my vpn appliance. how can i tell if they are still connected? I see the peer died line ...does that mean it was a disconnect?
February 19, 201313 yr Author Yes. Via telnet and ftp. oh crap. does that mean i might be compromised? how can I tell if they are logged in? or ftping stuff out?
February 20, 201313 yr Doesn't look too concerning to me. More like your VPN appliance probed your ports for some reason. Check its' log file. If someone was gaining access through VPN they would get an IP on your local LAN but it wouldn't be your VPN appliances IP.
Archived
This topic is now archived and is closed to further replies.