Is someone trying to hack into my FreeNAS???

[butterwrath]

Hey guys,

I configured my FreeNAS to send me emails, and I got this this morning...

Code:

Archon.local login failures:
Dec 10 06:28:43 Archon sshd[96570]: Invalid user zhangyan from 187.210.58.215
Dec 10 06:28:43 Archon sshd[96570]: input_userauth_request: invalid user zhangyan [preauth]
Dec 10 06:28:44 Archon sshd[96570]: Failed password for invalid user zhangyan from 187.210.58.215 port 46294 ssh2
Dec 10 06:28:46 Archon sshd[96581]: Invalid user dff from 187.210.58.215
Dec 10 06:28:46 Archon sshd[96581]: input_userauth_request: invalid user dff [preauth]
Dec 10 06:28:47 Archon sshd[96581]: Failed password for invalid user dff from 187.210.58.215 port 47561 ssh2
Dec 10 06:28:50 Archon sshd[96583]: Failed password for root from 187.210.58.215 port 48322 ssh2
Dec 10 06:28:53 Archon sshd[96591]: Failed password for root from 187.210.58.215 port 49135 ssh2
Dec 10 06:28:58 Archon sshd[96593]: Failed password for root from 187.210.58.215 port 49889 ssh2
Dec 10 06:29:01 Archon sshd[96604]: Failed password for root from 187.210.58.215 port 50930 ssh2
Dec 10 06:29:04 Archon sshd[96634]: Failed password for root from 187.210.58.215 port 51788 ssh2
Dec 10 06:29:07 Archon sshd[96658]: Failed password for root from 187.210.58.215 port 52588 ssh2
Dec 10 06:29:11 Archon sshd[96669]: Failed password for root from 187.210.58.215 port 53374 ssh2
Dec 10 06:29:15 Archon sshd[96679]: Failed password for root from 187.210.58.215 port 54371 ssh2
Dec 10 06:29:18 Archon sshd[96701]: Failed password for root from 187.210.58.215 port 55411 ssh2
Dec 10 06:29:21 Archon sshd[96709]: Failed password for root from 187.210.58.215 port 56234 ssh2
Dec 10 06:29:25 Archon sshd[96711]: Failed password for root from 187.210.58.215 port 56997 ssh2
Dec 10 06:29:29 Archon sshd[96722]: Failed password for root from 187.210.58.215 port 57836 ssh2
Dec 10 06:29:33 Archon sshd[96730]: Failed password for root from 187.210.58.215 port 58787 ssh2
Dec 10 06:29:39 Archon sshd[96732]: Failed password for root from 187.210.58.215 port 59782 ssh2
Dec 10 06:29:45 Archon sshd[96749]: Failed password for root from 187.210.58.215 port 33083 ssh2
Dec 10 06:29:51 Archon sshd[96763]: Failed password for root from 187.210.58.215 port 34560 ssh2
Dec 10 06:29:54 Archon sshd[96774]: Failed password for root from 187.210.58.215 port 36061 ssh2
Dec 10 06:29:58 Archon sshd[96776]: Failed password for root from 187.210.58.215 port 36909 ssh2
Dec 10 06:30:01 Archon sshd[96790]: Failed password for root from 187.210.58.215 port 37652 ssh2
Dec 10 06:30:04 Archon sshd[96819]: Failed password for root from 187.210.58.215 port 38494 ssh2
Dec 10 06:30:10 Archon sshd[96837]: Failed password for root from 187.210.58.215 port 39285 ssh2
Dec 10 06:30:13 Archon sshd[96848]: Failed password for root from 187.210.58.215 port 40689 ssh2
Dec 10 06:30:20 Archon sshd[96862]: Failed password for root from 187.210.58.215 port 41621 ssh2
Dec 10 06:30:32 Archon sshd[96890]: Failed password for root from 187.210.58.215 port 43395 ssh2
Dec 10 06:30:38 Archon sshd[96907]: Failed password for root from 187.210.58.215 port 46055 ssh2
Dec 10 06:30:42 Archon sshd[96921]: Failed password for root from 187.210.58.215 port 46983 ssh2
Dec 10 06:30:45 Archon sshd[96926]: Failed password for root from 187.210.58.215 port 47879 ssh2
Dec 10 06:30:50 Archon sshd[96934]: Failed password for root from 187.210.58.215 port 48763 ssh2
Dec 10 06:30:55 Archon sshd[96942]: Failed password for root from 187.210.58.215 port 49968 ssh2
Dec 10 06:30:58 Archon sshd[96953]: Failed password for root from 187.210.58.215 port 51029 ssh2
Dec 10 06:31:02 Archon sshd[96961]: Failed password for root from 187.210.58.215 port 51894 ssh2
Dec 10 06:31:05 Archon sshd[96996]: Failed password for root from 187.210.58.215 port 52798 ssh2
Dec 10 06:31:09 Archon sshd[97008]: Failed password for root from 187.210.58.215 port 53603 ssh2
Dec 10 06:31:12 Archon sshd[97010]: Invalid user oracle from 187.210.58.215
Dec 10 06:31:12 Archon sshd[97010]: input_userauth_request: invalid user oracle [preauth]
Dec 10 06:31:12 Archon sshd[97010]: Failed password for invalid user oracle from 187.210.58.215 port 54402 ssh2
Dec 10 06:31:15 Archon sshd[97021]: Invalid user test from 187.210.58.215
Dec 10 06:31:15 Archon sshd[97021]: input_userauth_request: invalid user test [preauth]
Dec 10 06:31:16 Archon sshd[97021]: Failed password for invalid user test from 187.210.58.215 port 55393 ssh2
Dec 10 06:31:18 Archon sshd[97052]: Invalid user oracle from 187.210.58.215
Dec 10 06:31:18 Archon sshd[97052]: input_userauth_request: invalid user oracle [preauth]
Dec 10 06:31:19 Archon sshd[97052]: Failed password for invalid user oracle from 187.210.58.215 port 56196 ssh2
Dec 10 06:31:22 Archon sshd[97057]: Invalid user ubuntu from 187.210.58.215
Dec 10 06:31:22 Archon sshd[97057]: input_userauth_request: invalid user ubuntu [preauth]
Dec 10 06:31:23 Archon sshd[97057]: Failed password for invalid user ubuntu from 187.210.58.215 port 56994 ssh2
Dec 10 06:31:25 Archon sshd[97068]: Invalid user git from 187.210.58.215
Dec 10 06:31:25 Archon sshd[97068]: input_userauth_request: invalid user git [preauth]
Dec 10 06:31:27 Archon sshd[97068]: Failed password for invalid user git from 187.210.58.215 port 58005 ssh2
Dec 10 06:31:29 Archon sshd[97070]: Invalid user boot from 187.210.58.215
Dec 10 06:31:29 Archon sshd[97070]: input_userauth_request: invalid user boot [preauth]
Dec 10 06:31:30 Archon sshd[97070]: Failed password for invalid user boot from 187.210.58.215 port 58967 ssh2
Dec 10 06:31:33 Archon sshd[97084]: Invalid user 123456 from 187.210.58.215
Dec 10 06:31:33 Archon sshd[97084]: input_userauth_request: invalid user 123456 [preauth]
Dec 10 06:31:33 Archon sshd[97084]: Failed password for invalid user 123456 from 187.210.58.215 port 59827 ssh2
Dec 10 06:31:37 Archon sshd[97095]: Invalid user 123 from 187.210.58.215
Dec 10 06:31:37 Archon sshd[97095]: input_userauth_request: invalid user 123 [preauth]
Dec 10 06:31:37 Archon sshd[97095]: Failed password for invalid user 123 from 187.210.58.215 port 60651 ssh2
Dec 10 06:31:41 Archon sshd[97097]: Failed password for root from 187.210.58.215 port 33388 ssh2
Dec 10 06:31:44 Archon sshd[97108]: Failed password for root from 187.210.58.215 port 34450 ssh2
Dec 10 06:31:47 Archon sshd[97119]: Failed password for root from 187.210.58.215 port 35283 ssh2
Dec 10 06:31:51 Archon sshd[97121]: Failed password for root from 187.210.58.215 port 36071 ssh2
Dec 10 06:31:55 Archon sshd[97132]: Failed password for root from 187.210.58.215 port 37005 ssh2
Dec 10 06:31:58 Archon sshd[97134]: Failed password for root from 187.210.58.215 port 37833 ssh2
Dec 10 06:32:01 Archon sshd[97148]: Failed password for root from 187.210.58.215 port 38617 ssh2
Dec 10 06:32:04 Archon sshd[97179]: Failed password for root from 187.210.58.215 port 39411 ssh2
Dec 10 06:32:07 Archon sshd[97194]: Failed password for root from 187.210.58.215 port 40164 ssh2
Dec 10 06:32:11 Archon sshd[97208]: Failed password for root from 187.210.58.215 port 40975 ssh2
Dec 10 06:32:19 Archon sshd[97210]: Failed password for root from 187.210.58.215 port 42018 ssh2
Dec 10 06:32:25 Archon sshd[97244]: Failed password for root from 187.210.58.215 port 43965 ssh2
Dec 10 06:32:28 Archon sshd[97255]: Failed password for root from 187.210.58.215 port 45307 ssh2
Dec 10 06:32:37 Archon sshd[97266]: Failed password for root from 187.210.58.215 port 46384 ssh2
Dec 10 06:32:40 Archon sshd[97280]: Failed password for root from 187.210.58.215 port 48187 ssh2
Dec 10 06:32:45 Archon sshd[97294]: Failed password for root from 187.210.58.215 port 49179 ssh2
Dec 10 06:32:49 Archon sshd[97296]: Failed password for root from 187.210.58.215 port 50089 ssh2
Dec 10 06:32:55 Archon sshd[97307]: Failed password for root from 187.210.58.215 port 51066 ssh2
Dec 10 06:33:03 Archon sshd[97318]: Failed password for root from 187.210.58.215 port 52223 ssh2
Dec 10 06:33:07 Archon sshd[97377]: Failed password for root from 187.210.58.215 port 54003 ssh2
Dec 10 06:33:12 Archon sshd[97379]: Failed password for root from 187.210.58.215 port 55041 ssh2
Dec 10 06:33:16 Archon sshd[97390]: Failed password for root from 187.210.58.215 port 56230 ssh2
Dec 10 06:33:19 Archon sshd[97421]: Failed password for root from 187.210.58.215 port 57201 ssh2
Dec 10 06:33:22 Archon sshd[97423]: Failed password for root from 187.210.58.215 port 57970 ssh2
Dec 10 06:33:31 Archon sshd[97428]: Failed password for root from 187.210.58.215 port 58790 ssh2
Dec 10 06:33:34 Archon sshd[97448]: Failed password for root from 187.210.58.215 port 60914 ssh2
Dec 10 06:33:38 Archon sshd[97456]: Failed password for root from 187.210.58.215 port 33387 ssh2
Dec 10 06:33:41 Archon sshd[97470]: Failed password for root from 187.210.58.215 port 34412 ssh2
Dec 10 06:33:49 Archon sshd[97472]: Failed password for root from 187.210.58.215 port 35223 ssh2
Dec 10 06:33:53 Archon sshd[97492]: Failed password for root from 187.210.58.215 port 37084 ssh2
Dec 10 06:34:00 Archon sshd[97494]: Failed password for root from 187.210.58.215 port 38220 ssh2
Dec 10 06:34:08 Archon sshd[97526]: Failed password for root from 187.210.58.215 port 40042 ssh2
Dec 10 06:34:12 Archon sshd[97572]: Failed password for root from 187.210.58.215 port 41964 ssh2
Dec 10 06:34:20 Archon sshd[97586]: Failed password for root from 187.210.58.215 port 42859 ssh2
Dec 10 06:34:23 Archon sshd[97617]: Failed password for root from 187.210.58.215 port 44895 ssh2
Dec 10 06:34:30 Archon sshd[97631]: Failed password for root from 187.210.58.215 port 46288 ssh2
Dec 10 06:34:34 Archon sshd[97639]: Failed password for root from 187.210.58.215 port 47632 ssh2
Dec 10 06:34:38 Archon sshd[97644]: Failed password for root from 187.210.58.215 port 48407 ssh2
Dec 10 06:34:41 Archon sshd[97649]: Failed password for root from 187.210.58.215 port 49449 ssh2
Dec 10 06:34:45 Archon sshd[97657]: Failed password for root from 187.210.58.215 port 50287 ssh2
Dec 10 06:34:49 Archon sshd[97668]: Failed password for root from 187.210.58.215 port 51217 ssh2
Dec 10 06:34:53 Archon sshd[97670]: Failed password for root from 187.210.58.215 port 52242 ssh2
Dec 10 06:34:56 Archon sshd[97678]: Failed password for root from 187.210.58.215 port 53390 ssh2
Dec 10 06:35:03 Archon sshd[97680]: Failed password for root from 187.210.58.215 port 54189 ssh2
Dec 10 06:35:07 Archon sshd[97739]: Failed password for root from 187.210.58.215 port 55924 ssh2
Dec 10 06:35:10 Archon sshd[97742]: Failed password for root from 187.210.58.215 port 56947 ssh2
Dec 10 06:35:15 Archon sshd[97753]: Failed password for root from 187.210.58.215 port 57774 ssh2
Dec 10 06:35:19 Archon sshd[97784]: Failed password for root from 187.210.58.215 port 59120 ssh2
Dec 10 06:35:23 Archon sshd[97792]: Failed password for root from 187.210.58.215 port 60009 ssh2
Dec 10 06:35:26 Archon sshd[97794]: Failed password for root from 187.210.58.215 port 32769 ssh2
Dec 10 06:35:30 Archon sshd[97805]: Failed password for root from 187.210.58.215 port 33668 ssh2
Dec 10 06:35:36 Archon sshd[97816]: Failed password for root from 187.210.58.215 port 35084 ssh2
Dec 10 06:35:39 Archon sshd[97824]: Failed password for root from 187.210.58.215 port 36192 ssh2
Dec 10 06:35:44 Archon sshd[97832]: Failed password for root from 187.210.58.215 port 37040 ssh2
Dec 10 06:35:49 Archon sshd[97840]: Failed password for root from 187.210.58.215 port 38145 ssh2
Dec 10 06:35:53 Archon sshd[97851]: Failed password for root from 187.210.58.215 port 39280 ssh2
Dec 10 06:35:56 Archon sshd[97853]: Failed password for root from 187.210.58.215 port 40371 ssh2
Dec 10 06:36:02 Archon sshd[97867]: Failed password for root from 187.210.58.215 port 41197 ssh2
Dec 10 23:46:52 Archon sshd[48406]: Invalid user zhangyan from 124.74.213.36
Dec 10 23:46:52 Archon sshd[48406]: input_userauth_request: invalid user zhangyan [preauth]
Dec 10 23:46:52 Archon sshd[48406]: Failed password for invalid user zhangyan from 124.74.213.36 port 54144 ssh2

-- End of security output --

Has this happened to anyone before? What should I do?

Any input would be greatly appreciated. Thanks for your time!

 

[Jailer]

I'm betting you have port 22 open on your router to your freenas and SSH enabled. Set it to a non standard port on your freenas and those will go away.

 

[butterwrath]

Thank you for the prompt reply! I'll change SSH to another port and see what happens.

 

[DifferentStrokes]

Some routers allow for more advanced forwarding than 1:1 NAT. This allows you to pick a high port (say 12345) and forward that to port 22 on a internal machine. This is nice in that the port 22 can stay default on the server.

 

[tvsjr]

Or, put a decent router/firewall/security appliance in front of it, configure VPN, and don't expose SSH to the world at all.

 

[DifferentStrokes]

Or, put a decent router/firewall/security appliance in front of it, configure VPN, and don't expose SSH to the world at all.

Sound advice!

 

[danb35]

Or, put a decent router/firewall/security appliance in front of it, configure VPN, and don't expose SSH to the world at all.

Agreed. Note, though, that SSH itself is pretty secure, if configured properly. If you've disabled password logins (requiring public key auth instead), and disabled root logins (requiring login as a non-privileged user, then su to root if needed), there isn't a significant risk of an unauthorized login.

 

[butterwrath]

Or, put a decent router/firewall/security appliance in front of it, configure VPN, and don't expose SSH to the world at all.

I'm totally new to FreeNAS. Thing isn't even 2 weeks old... How do I hide SSH or configure the firewall? I'm working on getting PIA to work, since I already have a submission.

 

[butterwrath]

But as an update, I changed the port from 22 to a random number, and this is what I got today...

Code:

Archon.local kernel log messages:
> arp: 10.0.0.137 moved from 02:b2:8a:00:0e:0a to 00:14:5e:77:73:6d on epair0b
> arp: 10.0.0.137 moved from 02:b2:8a:00:0e:0a to 00:14:5e:77:73:6d on epair0b

Archon.local login failures:
Dec 11 00:00:16 Archon sshd[50321]: Invalid user zhangyan from 122.144.196.177
Dec 11 00:00:16 Archon sshd[50321]: input_userauth_request: invalid user zhangyan [preauth]
Dec 11 00:00:16 Archon sshd[50321]: Failed password for invalid user zhangyan from 122.144.196.177 port 56218 ssh2
Dec 11 00:00:18 Archon sshd[50335]: Invalid user dff from 122.144.196.177
Dec 11 00:00:18 Archon sshd[50335]: input_userauth_request: invalid user dff [preauth]
Dec 11 00:00:19 Archon sshd[50335]: Failed password for invalid user dff from 122.144.196.177 port 57094 ssh2
Dec 11 00:00:21 Archon sshd[50337]: Failed password for root from 122.144.196.177 port 58024 ssh2
Dec 11 00:00:24 Archon sshd[50362]: Failed password for root from 122.144.196.177 port 58910 ssh2
Dec 11 00:00:26 Archon sshd[50364]: Failed password for root from 122.144.196.177 port 59792 ssh2
Dec 11 00:00:29 Archon sshd[50378]: Failed password for root from 122.144.196.177 port 60720 ssh2
Dec 11 00:00:31 Archon sshd[50380]: Failed password for root from 122.144.196.177 port 61596 ssh2
Dec 11 00:00:34 Archon sshd[50388]: Failed password for root from 122.144.196.177 port 62519 ssh2
Dec 11 00:00:37 Archon sshd[50396]: Failed password for root from 122.144.196.177 port 63517 ssh2
Dec 11 00:05:48 Archon sshd[51135]: Failed password for root from 119.146.221.68 port 57899 ssh2
Dec 11 00:05:51 Archon sshd[51137]: Failed password for root from 119.146.221.68 port 58815 ssh2
Dec 11 00:05:53 Archon sshd[51151]: Failed password for root from 119.146.221.68 port 59753 ssh2
Dec 11 00:05:56 Archon sshd[51170]: Failed password for root from 119.146.221.68 port 60628 ssh2
Dec 11 00:05:59 Archon sshd[51178]: Failed password for root from 119.146.221.68 port 33321 ssh2
Dec 11 00:06:02 Archon sshd[51180]: Failed password for root from 119.146.221.68 port 34225 ssh2
Dec 11 00:06:05 Archon sshd[51220]: Failed password for root from 119.146.221.68 port 35119 ssh2
Dec 11 00:06:07 Archon sshd[51222]: Failed password for root from 119.146.221.68 port 36025 ssh2
Dec 11 00:06:10 Archon sshd[51234]: Failed password for root from 119.146.221.68 port 36915 ssh2
Dec 11 00:06:13 Archon sshd[51236]: Failed password for root from 119.146.221.68 port 37802 ssh2
Dec 11 00:06:16 Archon sshd[51247]: Failed password for root from 119.146.221.68 port 38724 ssh2
Dec 11 00:06:19 Archon sshd[51249]: Failed password for root from 119.146.221.68 port 39648 ssh2
Dec 11 03:55:51 Archon sshd[85403]: Failed password for root from 185.112.102.222 port 48531 ssh2
Dec 11 03:55:52 Archon sshd[85405]: Failed password for root from 185.112.102.222 port 51422 ssh2
Dec 11 03:55:53 Archon sshd[85407]: Failed password for root from 185.112.102.222 port 54246 ssh2
Dec 11 03:55:54 Archon sshd[85409]: Invalid user admin from 185.112.102.222
Dec 11 03:55:54 Archon sshd[85409]: input_userauth_request: invalid user admin [preauth]
Dec 11 03:55:54 Archon sshd[85409]: Failed password for invalid user admin from 185.112.102.222 port 57269 ssh2
Dec 11 03:55:54 Archon sshd[85411]: Invalid user admin from 185.112.102.222
Dec 11 03:55:54 Archon sshd[85411]: input_userauth_request: invalid user admin [preauth]
Dec 11 03:55:54 Archon sshd[85411]: Failed password for invalid user admin from 185.112.102.222 port 60156 ssh2
Dec 11 03:55:55 Archon sshd[85425]: Invalid user test from 185.112.102.222
Dec 11 03:55:55 Archon sshd[85425]: input_userauth_request: invalid user test [preauth]
Dec 11 03:55:55 Archon sshd[85425]: Failed password for invalid user test from 185.112.102.222 port 34673 ssh2
Dec 11 03:55:56 Archon sshd[85427]: Invalid user guest from 185.112.102.222
Dec 11 03:55:56 Archon sshd[85427]: input_userauth_request: invalid user guest [preauth]
Dec 11 03:55:56 Archon sshd[85427]: Failed password for invalid user guest from 185.112.102.222 port 37537 ssh2
Dec 11 03:55:57 Archon sshd[85429]: Invalid user user from 185.112.102.222
Dec 11 03:55:57 Archon sshd[85429]: input_userauth_request: invalid user user [preauth]
Dec 11 03:55:57 Archon sshd[85429]: Failed password for invalid user user from 185.112.102.222 port 40177 ssh2
Dec 11 03:55:58 Archon sshd[85431]: Invalid user admin from 185.112.102.222
Dec 11 03:55:58 Archon sshd[85431]: input_userauth_request: invalid user admin [preauth]
Dec 11 03:55:58 Archon sshd[85431]: Failed password for invalid user admin from 185.112.102.222 port 42759 ssh2
Dec 11 03:55:59 Archon sshd[85433]: Invalid user admin from 185.112.102.222
Dec 11 03:55:59 Archon sshd[85433]: input_userauth_request: invalid user admin [preauth]
Dec 11 03:55:59 Archon sshd[85433]: Failed password for invalid user admin from 185.112.102.222 port 45636 ssh2

-- End of security output --

 

[danb35]

How do I hide SSH or configure the firewall?

FreeNAS doesn't include a firewall. Presumably you have some sort of Internet router/gateway/NAT device; you'd find instructions on configuring that in its documentation--it's entirely off-topic here. As to SSH, ideally you'd disable root logins and disable password authentication. The manual has instructions for doing this, and this thread discusses setting up public key authentication.

I'm writing on the assumption that your FreeNAS server is behind a router/firewall of some sort. If that is not the case, stop, power it down, unplug it, and install a router/firewall. Then erase the FreeNAS USB stick and do a clean reinstall, and put your server behind that firewall. FreeNAS is not designed or hardened to be openly exposed to the Internet, and if you've done so, it's entirely possible that your system has already been compromised.

 

[butterwrath]

FreeNAS is not designed or hardened to be openly exposed to the Internet, and if you've done so, it's entirely possible that your system has already been compromised.

Will this go away if I just disable SSH? I never even got SSH to work yet. My server is currently running at my friend's house because I live on school campus, so I don't have access to the router to forward ports. I set up router configurations at my friend's house, but recall that his firewall settings was set to minimum. I only use the server remotely for now and only wanted to use SSH to back up stuff. It's more of a nice-to-have thing for me as opposed to it being a necessity.

 

[pirateghost]

Will this go away if I just disable SSH? I never even got SSH to work yet. My server is currently running at my friend's house because I live on school campus, so I don't have access to the router to forward ports. I set up router configurations at my friend's house, but recall that his firewall settings was set to minimum. I only use the server remotely for now and only wanted to use SSH to back up stuff. It's more of a nice-to-have thing for me as opposed to it being a necessity.

Have your friend disable the port forward

 

[danb35]

How are you currently accessing your data and the web GUI on the server?

 

[butterwrath]

Have your friend disable the port forward

the original port 22 i forwarded?

 

[pirateghost]

the original port 22 i forwarded?

Yes

 

[butterwrath]

How are you currently accessing your data and the web GUI on the server?

I currently don't have access to the data other than Plex. I added media and some backup files to the server before moving it and setting it up at my friend's place. I was able to set up and configure Plex remotely through the web GUI. I also set up a DDNS with no-ip to access the WebGUI.

 

[Jailer]

You're gonna be getting a visit from the Russian Mafia..........

 

[danb35]

Paging @RussianMafia...

 

[butterwrath]

Sigh. Is this your way of telling me that I'm already screwed?

 

[danb35]

I also set up a DDNS with no-ip to access the WebGUI.

...but how did you do this? Dynamic DNS will not give you access to a web server that's behind a standard home router, much less a proper firewall. Do you have port 80 open to the outside as well? If so, you should consider yourself screwed--the FreeNAS web GUI just doesn't have safeguards in place that would make it appropriate to expose it to the Internet. I'm certainly not saying someone has hacked your box--but I am saying someone could have, and you really wouldn't have any way to know.