[H-GEN] FTP login by wtmp?

[Everist, Geoff]

[ Humbug *General* list - semi-serious discussions about Humbug and
Unix-related topics. ]

[snip]
> Folks,
> 
> Anyone following up on this thread should be aware of the following
> HUMBUG List Netiquette,
> 
>     ... due to the large number of System Administrators working
>     for various ISPs in HUMBUG, discussion of the relative merits of
>     different ISPs on the list is discouraged.
> 
>     http://www.humbug.org.au/member.html
> 

Yes, a very valid point. I thought carefully about that before posting
originally. I wasn't trying to intiate a discussion about relative merits of
specific ISP's, but trying to understand what the norm would be in this type
of situation, and to get a better understanding of what ISP sysops go
through with respect to follow-up of security related issues. As I have not
had much experience with this type of attack, I was unsure of how seriously
it should be taken (I had my own ideas, but was not sure whether they were
reasonable). The responses on the list, especially from the sysop
perspective have been very educational.

[snip]
> 
> There should generally be a response, even if it's "Sorry, we can't
> do anything with this".  Normally 24-48 hours is enough; however,
> you should take into account local holidays, weekends and time zones.
> To quote:
> 
>     Remember that people with whom you communicate are located across
>     the globe.  If you send a message to which you want an immediate
>     response, the person receiving it might be at home asleep when it
>     arrives.  Give them a chance to wake up, come to work, and login
>     before assuming the mail didn't arrive or that they don't care.
> 
>     http://mirror.aarnet.edu.au/rfc/rfc1855.txt
> 

Yep, good point again (this has well expired in our case).

[snip]
> 
>     whois -h whois.apnic.net 203.109.224.0/19
>     whois -h whois.patho.gen.nz ihug.co.nz
> 
Generally for an abuse complaint we look up the SOA record, and send an
email to the listed responsible person, with a copy to abuse. In this case
we actually rang the ISP and specifically asked for a technical contact.

Thanks for your suggestions,

Cheers
Geoff Everist

[snip]

--
This is list (humbug) general handled by majordomo at lists.humbug.org.au .
Postings only from subscribed addresses of lists general or general-post.