I have, what I hope, is a fairly secure internet set up. My AT&T U-verse modem goes directly into a pfSense hardware firewall. I wanted to set up an FTP site for a friend to download some files, so I put a Raspberry Pi connected directly to the U-verse modem and had the modem redirect a random port to the Pi's standard FTP port. I have only two logins on the Pi, one for him and one for me.
I figure that sticking this Pi out there was no big deal, even if someone could get onto it, all it had was some books on it, and no way to get around the hardware firewall.
Some weeks later tho, I started noticing my Internet connection getting flaky - very often when attempting to bring up a web page there'd be a DNS failure, connections themselves were very slow to start. On a hunch, I disconnected the Pi and instantly cleared up and I haven't had a dns failure since. Hmmm.
Does the Pi keep any logs of what might have been happening to it? Obviously it was being subjected to some kind of attack, but what? And who? thanks, Larry