Today when I came home to my linux box and booted the syslog came up as failed on startup. When I try to run top it gives me an error about a missing file. My linux box had been running default red hat 7.1 ftp telnet ssh and http servers with no firewall protection. Also when I try to start KDE the task bar doesn't load. The last message in /var/log/messages is of an annonymous ftp login using a very fake sounding email.

So did someone get on my linux box or am I just overreacting. Thanks in advance.

i put my router firewall up again and disabled annonymous ftp access in the ftp users file. Anyone know how I can fix top, kde, and get logging going again. I'm going to take security much more seriously now.

Whilst missing panel bits and startup problems are not a new concept, particularly when you accidentally pull the power lead when you get up from your chair (!), the anonymous ftp screams hack. Get the box offline if you can, and run chkrootkit, also what commands do you see if you use the cursor up keys in root/user accounts. You'll probably have to reinstall. A firewall would be a very good idea.
Jim

on the root accounts the up and down arrow keys only produce my stuff. The box is down now and is booted into windows

do you know how I can get top, the system logger and kde working again. Thanks

It's possible you could re-install the relevant bits and be OK, but you should be afraid. A reinstall is safest, have you got any critical data on the system? Did you install tripwire? I did, and always wondered why, it sends me mail whenever I redo the kernel, which is very irritating, but when I'm worried I've been hacked it doesn't, therefore I've "probably" not been.
Jim

i think I will reinstall I've had to do it twice now so it doesn't take me long to get everything back in shape.

ok I'm reinstalled how can I keep this kind of thing from happening again. How can I disable anonymous ftp. Thanks.

anyone have some advice

- remove the anonftp package if installed,
- remove /etc/{passwd,group,shadow,ftpusers} entries for user FTP, associated with anonymous ftp account
- find out what the base address is the ftpd chroot's to to allow anon ftp access, and remove all authentication files, binaries, devices and libraries from where the ftp account is
- review your configs and access lists in /etc(/fptd) so user FTP isn't listed, and anything referring to class anonymous is deleted.
- restart ftpd and check logging in, check ftpd log and syslog for errors.