| View previous topic :: View next topic |
| Author |
Message |
Rukie
l33t
Joined: 26 Jan 2004
Posts: 692
Location: SE Wi, Home of cheese and cowtippers.......
|
 Posted: Sun Aug 05, 2007 2:31 am Post subject: Who says security isn't important for a home user?!? |
 |
|
Lol, I was just looking through some logs on my, unfortunately, unsecured computer behind a NAT, and I noticed a couple interesting things... and provacative things! 
Anyways, for those of you who think that they are secure in a NAT (all be it, I do have port 22 forwarded to this machine so that I may do a socks proxy through a tunnel (great bypass method) just look at this, my log.
This is everything related to ssh through syslog-ng.
| Quote: |
Jul 16 18:15:02 localhost sshd[12417]: Server listening on :: port 22.
Jul 16 18:15:02 localhost sshd[12417]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 16 18:52:56 localhost sshd[13946]: Accepted keyboard-interactive/pam for root from 192.168.1.154 port 55056 ssh2
Jul 16 18:52:56 localhost sshd(pam_unix)[13949]: session opened for user root by root(uid=0)
Jul 17 01:39:30 localhost sshd[21549]: Did not receive identification string from 219.84.161.123
Jul 17 01:42:17 localhost sshd[21562]: Address 219.84.161.123 maps to 219-84-161-123.sonet.coowo.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 17 01:42:17 localhost sshd[21562]: Invalid user staff from 219.84.161.123
Jul 17 01:42:19 localhost sshd[21564]: Address 219.84.161.123 maps to 219-84-161-123.sonet.coowo.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 17 01:42:19 localhost sshd[21564]: Invalid user sales from 219.84.161.123
Jul 17 01:42:21 localhost sshd[21566]: Address 219.84.161.123 maps to 219-84-161-123.sonet.coowo.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 17 01:42:21 localhost sshd[21566]: Invalid user recruit from 219.84.161.123
Jul 17 01:42:22 localhost sshd[21568]: Address 219.84.161.123 maps to 219-84-161-123.sonet.coowo.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 17 01:42:22 localhost sshd[21568]: Invalid user alias from 219.84.161.123
Jul 17 01:42:24 localhost sshd[21570]: Address 219.84.161.123 maps to 219-84-161-123.sonet.coowo.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 17 01:42:24 localhost sshd[21570]: Invalid user office from 219.84.161.123
Jul 17 07:01:32 localhost sshd[8851]: Invalid user test from 61.146.178.13
Jul 17 07:01:36 localhost sshd[8853]: Invalid user guest from 61.146.178.13
Jul 17 07:01:41 localhost sshd[8855]: Invalid user admin from 61.146.178.13
Jul 17 07:01:47 localhost sshd[8858]: Invalid user admin from 61.146.178.13
Jul 17 07:01:51 localhost sshd[8860]: Invalid user user from 61.146.178.13
Jul 17 17:50:20 localhost sshd[12417]: Received signal 15; terminating.
Jul 17 18:05:12 localhost sshd[5710]: Server listening on :: port 22.
Jul 17 18:05:12 localhost sshd[5710]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 17 18:13:08 localhost sshd[5754]: Server listening on :: port 22.
Jul 17 18:13:08 localhost sshd[5754]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 18 11:10:27 localhost sshd[32644]: Did not receive identification string from 210.51.190.248
Jul 18 11:15:07 localhost sshd[32645]: Invalid user webmaster from 210.51.190.248
Jul 18 11:15:13 localhost sshd[32649]: Invalid user ftp from 210.51.190.248
Jul 18 11:15:16 localhost sshd[32651]: Invalid user sales from 210.51.190.248
Jul 18 11:15:19 localhost sshd[32653]: Invalid user admin from 210.51.190.248
Jul 18 16:30:57 localhost sshd[5754]: Received signal 15; terminating.
Jul 18 16:31:56 localhost sshd[5198]: Server listening on :: port 22.
Jul 18 16:31:56 localhost sshd[5198]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 18 22:15:07 localhost sshd[13255]: Did not receive identification string from 125.74.221.254
Jul 18 22:22:02 localhost sshd[13268]: Invalid user guest from 125.74.221.254
Jul 19 03:37:47 localhost sshd[6367]: Invalid user linea from 84.19.255.194
Jul 19 03:37:49 localhost sshd[6369]: Invalid user linear from 84.19.255.194
Jul 19 03:37:51 localhost sshd[6371]: Invalid user linebarger from 84.19.255.194
Jul 19 03:37:53 localhost sshd[6373]: Invalid user linebaugh from 84.19.255.194
Jul 19 03:37:56 localhost sshd[6375]: Invalid user lineberry from 84.19.255.194
Jul 19 15:46:41 localhost sshd[5198]: Received signal 15; terminating.
Jul 19 15:47:41 localhost sshd[5348]: Server listening on :: port 22.
Jul 19 15:47:41 localhost sshd[5348]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 19 20:56:44 localhost sshd[5541]: Server listening on :: port 22.
Jul 19 20:56:44 localhost sshd[5541]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 19 21:04:45 localhost rc-scripts: WARNING: sshd has already been started.
Jul 19 21:22:22 localhost sshd[30680]: Did not receive identification string from 83.12.247.75
Jul 19 21:29:14 localhost sshd[12127]: Invalid user staff from 83.12.247.75
Jul 19 21:29:17 localhost sshd[14467]: Invalid user sales from 83.12.247.75
Jul 19 21:29:20 localhost sshd[16236]: Invalid user recruit from 83.12.247.75
Jul 19 21:29:23 localhost sshd[18451]: Invalid user alias from 83.12.247.75
Jul 19 21:29:27 localhost sshd[20263]: Invalid user office from 83.12.247.75
Jul 19 21:51:23 localhost sshd[3506]: Accepted keyboard-interactive/pam for rukie from 192.168.1.154 port 48673 ssh2
Jul 19 21:51:23 localhost sshd[5514]: pam_unix(sshd:session): session opened for user rukie by (uid=0)
Jul 19 21:51:37 localhost sshd[5514]: pam_unix(sshd:session): session closed for user rukie
Jul 19 22:01:21 localhost sshd[5541]: Received signal 15; terminating.
Jul 19 22:02:31 localhost sshd[4613]: Server listening on :: port 22.
Jul 19 22:02:31 localhost sshd[4613]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 20 01:31:58 localhost sshd[25979]: Did not receive identification string from 83.3.203.26
Jul 20 01:38:53 localhost sshd[25980]: Invalid user abba from 83.3.203.26
Jul 20 01:38:55 localhost sshd[25982]: Invalid user account from 83.3.203.26
Jul 20 01:38:58 localhost sshd[25984]: Invalid user adam from 83.3.203.26
Jul 20 01:39:01 localhost sshd[25986]: Invalid user admin from 83.3.203.26
Jul 20 01:39:05 localhost sshd[25988]: Invalid user admin from 83.3.203.26
Jul 20 07:31:18 localhost sshd[26774]: Did not receive identification string from 83.16.104.172
Jul 20 07:38:14 localhost sshd[26775]: Invalid user staff from 83.16.104.172
Jul 20 07:38:16 localhost sshd[26777]: Invalid user sales from 83.16.104.172
Jul 20 07:38:18 localhost sshd[26779]: Invalid user recruit from 83.16.104.172
Jul 20 07:38:20 localhost sshd[26781]: Invalid user alias from 83.16.104.172
Jul 20 07:38:22 localhost sshd[26783]: Invalid user office from 83.16.104.172
Jul 20 17:40:52 localhost sshd[27537]: Accepted keyboard-interactive/pam for rukie from 192.168.1.154 port 34838 ssh2
Jul 20 17:40:52 localhost sshd[27540]: pam_unix(sshd:session): session opened for user rukie by (uid=0)
Jul 20 17:44:49 localhost sshd[9211]: Accepted keyboard-interactive/pam for rukie from 192.168.1.154 port 34839 ssh2
Jul 20 17:44:49 localhost sshd[10773]: pam_unix(sshd:session): session opened for user rukie by (uid=0)
Jul 20 18:45:01 localhost sshd[10773]: pam_unix(sshd:session): session closed for user rukie
Jul 21 08:43:50 localhost sshd[4613]: Received signal 15; terminating.
Jul 21 08:44:37 localhost sshd[4542]: Server listening on :: port 22.
Jul 21 08:44:37 localhost sshd[4542]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 21 10:36:02 localhost sshd[4542]: Received signal 15; terminating.
Jul 21 10:36:03 localhost sshd[7348]: Server listening on :: port 22.
Jul 21 10:36:03 localhost sshd[7348]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 21 15:05:22 localhost sshd[8007]: Accepted keyboard-interactive/pam for rukie from 192.168.1.154 port 45016 ssh2
Jul 21 15:05:22 localhost sshd[8010]: pam_unix(sshd:session): session opened for user rukie by (uid=0)
Jul 21 15:05:29 localhost sshd[7348]: Received signal 15; terminating.
Jul 21 15:06:44 localhost sshd[4540]: Server listening on :: port 22.
Jul 21 15:06:44 localhost sshd[4540]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 21 15:07:38 localhost sshd[4540]: Received signal 15; terminating.
Jul 21 15:08:45 localhost sshd[4536]: Server listening on :: port 22.
Jul 21 15:08:45 localhost sshd[4536]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 21 15:12:57 localhost sshd[4536]: Received signal 15; terminating.
Jul 21 22:12:09 localhost sshd[4541]: Server listening on :: port 22.
Jul 21 22:12:09 localhost sshd[4541]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 21 22:14:05 localhost sshd[4541]: Received signal 15; terminating.
Jul 22 08:28:07 localhost sshd[4601]: Server listening on :: port 22.
Jul 22 08:28:07 localhost sshd[4601]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 22 08:34:47 localhost sshd[4601]: Received signal 15; terminating.
Jul 22 14:01:22 localhost sshd[4532]: Server listening on :: port 22.
Jul 22 14:01:22 localhost sshd[4532]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 22 14:28:08 localhost sshd[18094]: Accepted keyboard-interactive/pam for root from 192.168.1.154 port 54423 ssh2
Jul 22 14:28:08 localhost sshd[18097]: pam_unix(sshd:session): session opened for user root by root(uid=0)
Jul 22 14:28:49 localhost sshd[4532]: Received signal 15; terminating.
Jul 22 15:05:51 localhost sshd[4538]: Server listening on :: port 22.
Jul 22 15:05:51 localhost sshd[4538]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 23 09:08:43 localhost sshd[8362]: Did not receive identification string from 59.120.75.220
Jul 23 09:11:43 localhost sshd[8375]: Did not receive identification string from 59.120.75.220
Jul 24 02:09:12 localhost sshd[15787]: Did not receive identification string from 59.106.20.91
Jul 24 02:16:07 localhost sshd[15800]: Invalid user staff from 59.106.20.91
Jul 24 02:16:08 localhost sshd[15802]: Invalid user sales from 59.106.20.91
Jul 24 02:16:10 localhost sshd[15804]: Invalid user recruit from 59.106.20.91
Jul 24 02:16:12 localhost sshd[15806]: Invalid user alias from 59.106.20.91
Jul 24 02:16:13 localhost sshd[15808]: Invalid user office from 59.106.20.91
Jul 24 03:42:27 localhost sshd[15998]: Invalid user test from 211.140.51.13
Jul 24 03:42:29 localhost sshd[16000]: Invalid user guest from 211.140.51.13
Jul 24 03:42:32 localhost sshd[16002]: Invalid user admin from 211.140.51.13
Jul 24 03:42:35 localhost sshd[16004]: Invalid user admin from 211.140.51.13
Jul 24 03:42:37 localhost sshd[16006]: Invalid user user from 211.140.51.13
Jul 24 17:35:10 localhost sshd[4538]: Received signal 15; terminating.
Jul 24 18:19:15 localhost sshd[4661]: Server listening on :: port 22.
Jul 24 18:19:15 localhost sshd[4661]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 24 21:42:50 localhost sshd[4661]: Received signal 15; terminating.
Jul 25 16:55:46 localhost sshd[4826]: Server listening on :: port 22.
Jul 25 16:55:46 localhost sshd[4826]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 25 18:47:01 localhost sshd[10967]: Did not receive identification string from 88.191.16.77
Jul 26 03:42:14 localhost sshd[11877]: Invalid user test from 61.146.178.8
Jul 26 03:42:20 localhost sshd[11879]: Invalid user guest from 61.146.178.8
Jul 26 03:42:24 localhost sshd[11881]: Invalid user admin from 61.146.178.8
Jul 26 03:42:28 localhost sshd[11883]: Invalid user admin from 61.146.178.8
Jul 26 03:42:33 localhost sshd[11885]: Invalid user user from 61.146.178.8
Jul 27 12:42:55 localhost sshd[15095]: Did not receive identification string from 59.42.176.143
Jul 27 16:26:26 localhost sshd[15400]: Did not receive identification string from 200.46.248.214
Jul 27 16:33:16 localhost sshd[15414]: Invalid user staff from 200.46.248.214
Jul 27 16:33:17 localhost sshd[15416]: Invalid user sales from 200.46.248.214
Jul 27 16:33:18 localhost sshd[15418]: Invalid user recruit from 200.46.248.214
Jul 27 16:33:20 localhost sshd[15420]: Invalid user alias from 200.46.248.214
Jul 27 16:33:21 localhost sshd[15422]: Invalid user office from 200.46.248.214
Jul 27 16:42:23 localhost sshd[15439]: Did not receive identification string from 195.80.224.234
Jul 29 00:25:47 localhost sshd[18963]: Invalid user test from 86.122.47.11
Jul 29 00:25:49 localhost sshd[18965]: Invalid user guest from 86.122.47.11
Jul 29 00:25:51 localhost sshd[18967]: Invalid user admin from 86.122.47.11
Jul 29 00:25:53 localhost sshd[18969]: Invalid user admin from 86.122.47.11
Jul 29 00:25:55 localhost sshd[18971]: Invalid user user from 86.122.47.11
Jul 29 02:45:00 localhost sshd[19160]: Address 61.178.224.235 maps to 235.224.178.61.dail.by.gs.dynamic.163data.com.cn, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 29 02:45:00 localhost sshd[19160]: Invalid user test from 61.178.224.235
Jul 29 02:45:03 localhost sshd[19162]: Address 61.178.224.235 maps to 235.224.178.61.dail.by.gs.dynamic.163data.com.cn, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 29 02:45:03 localhost sshd[19162]: Invalid user guest from 61.178.224.235
Jul 29 02:45:05 localhost sshd[19164]: Address 61.178.224.235 maps to 235.224.178.61.dail.by.gs.dynamic.163data.com.cn, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 29 02:45:05 localhost sshd[19164]: Invalid user admin from 61.178.224.235
Jul 29 02:45:08 localhost sshd[19166]: Address 61.178.224.235 maps to 235.224.178.61.dail.by.gs.dynamic.163data.com.cn, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 29 02:45:08 localhost sshd[19166]: Invalid user admin from 61.178.224.235
Jul 29 02:45:11 localhost sshd[19168]: Address 61.178.224.235 maps to 235.224.178.61.dail.by.gs.dynamic.163data.com.cn, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 29 02:45:11 localhost sshd[19168]: Invalid user user from 61.178.224.235
Jul 29 08:25:27 localhost sshd[19753]: Accepted keyboard-interactive/pam for rukie from 192.168.1.154 port 46180 ssh2
Jul 29 08:25:27 localhost sshd[19756]: pam_unix(sshd:session): session opened for user rukie by (uid=0)
Jul 29 08:25:41 localhost sshd[4826]: Received signal 15; terminating.
Jul 29 09:16:48 localhost sshd[4687]: Server listening on :: port 22.
Jul 29 09:16:48 localhost sshd[4687]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 30 14:29:56 localhost sshd[4811]: Server listening on :: port 22.
Jul 30 14:29:56 localhost sshd[4811]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.
Jul 30 20:37:21 localhost sshd[11447]: Accepted keyboard-interactive/pam for rukie from 192.168.1.154 port 46522 ssh2
Jul 30 20:37:21 localhost sshd[11450]: pam_unix(sshd:session): session opened for user rukie by (uid=0)
Jul 30 20:37:21 localhost sshd[11450]: error: channel 0: chan_read_failed for istate 3
Jul 30 20:37:21 localhost sshd[11450]: error: channel 0: chan_read_failed for istate 3
Jul 30 20:37:21 localhost sshd[11450]: error: channel 0: chan_read_failed for istate 3
Jul 30 20:37:21 localhost sshd[11450]: pam_unix(sshd:session): session closed for user rukie
Jul 30 20:37:27 localhost sshd[11452]: Accepted keyboard-interactive/pam for rukie from 192.168.1.154 port 46523 ssh2
Jul 30 20:37:27 localhost sshd[11455]: pam_unix(sshd:session): session opened for user rukie by (uid=0)
Jul 30 20:41:00 localhost sshd[11455]: pam_unix(sshd:session): session closed for user rukie
Jul 31 16:28:06 localhost sshd[30251]: Did not receive identification string from 216.187.149.53
Jul 31 16:35:06 localhost sshd[30264]: Address 216.187.149.53 maps to lanip0053.static.bil.oneeighty.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 31 16:35:07 localhost sshd[30266]: Address 216.187.149.53 maps to lanip0053.static.bil.oneeighty.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 31 16:35:08 localhost sshd[30268]: Address 216.187.149.53 maps to lanip0053.static.bil.oneeighty.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 31 16:35:09 localhost sshd[30270]: Address 216.187.149.53 maps to lanip0053.static.bil.oneeighty.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul 31 16:35:11 localhost sshd[30272]: Address 216.187.149.53 maps to lanip0053.static.bil.oneeighty.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Aug 1 09:18:30 localhost sshd[31969]: Did not receive identification string from 222.36.16.253
Aug 1 09:25:25 localhost sshd[31983]: Invalid user admin from 222.36.16.253
Aug 1 11:55:11 localhost sshd[32192]: Did not receive identification string from 79.119.32.88
Aug 1 12:02:34 localhost sshd[32207]: Address 79.119.32.88 maps to 79-119-32-88.rdsnet.ro, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Aug 1 18:15:45 localhost sshd[5107]: Invalid user test from 61.236.64.56
Aug 1 18:15:47 localhost sshd[5109]: Invalid user guest from 61.236.64.56
Aug 1 18:15:49 localhost sshd[5111]: Invalid user admin from 61.236.64.56
Aug 1 18:15:52 localhost sshd[5113]: Invalid user admin from 61.236.64.56
Aug 1 18:15:54 localhost sshd[5115]: Invalid user user from 61.236.64.56
Aug 2 06:18:10 localhost sshd[13355]: Did not receive identification string from 202.171.152.211
Aug 2 08:56:25 localhost sshd[13583]: Did not receive identification string from 208.71.152.19
Aug 2 12:46:09 localhost sshd[13914]: Did not receive identification string from 212.174.90.253
Aug 3 03:22:04 localhost sshd[1859]: Did not receive identification string from 195.74.60.25
Aug 3 04:16:34 localhost sshd[1933]: Address 195.74.60.25 maps to node2.brickworld.org.uk, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Aug 3 04:16:34 localhost sshd[1933]: Invalid user admin from 195.74.60.25
Aug 3 04:16:35 localhost sshd[1935]: Address 195.74.60.25 maps to node2.brickworld.org.uk, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Aug 3 04:16:36 localhost sshd[1937]: Address 195.74.60.25 maps to node2.brickworld.org.uk, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Aug 3 04:16:36 localhost sshd[1937]: Invalid user stud from 195.74.60.25
Aug 3 04:16:37 localhost sshd[1939]: Address 195.74.60.25 maps to node2.brickworld.org.uk, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Aug 3 04:16:37 localhost sshd[1939]: Invalid user trash from 195.74.60.25
Aug 3 04:16:38 localhost sshd[1941]: Address 195.74.60.25 maps to node2.brickworld.org.uk, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Aug 3 04:16:38 localhost sshd[1941]: Invalid user aaron from 195.74.60.25
Aug 3 05:28:56 localhost sshd[2042]: Did not receive identification string from 80.118.190.20
Aug 3 18:52:28 localhost sshd[3571]: Accepted keyboard-interactive/pam for root from 192.168.1.154 port 1115 ssh2
Aug 3 18:52:28 localhost sshd[3574]: pam_unix(sshd:session): session opened for user root by root(uid=0)
Aug 3 21:04:04 localhost sshd[24336]: Invalid user test from 221.204.251.32
Aug 3 21:04:07 localhost sshd[24339]: Invalid user guest from 221.204.251.32
Aug 3 21:04:09 localhost sshd[24341]: Invalid user admin from 221.204.251.32
Aug 3 21:04:11 localhost sshd[24346]: Invalid user admin from 221.204.251.32
Aug 3 21:04:14 localhost sshd[24348]: Invalid user user from 221.204.251.32
Aug 4 04:10:17 localhost sshd[26737]: Invalid user test from 218.55.193.136
Aug 4 04:10:20 localhost sshd[26739]: Invalid user guest from 218.55.193.136
Aug 4 04:10:22 localhost sshd[26741]: Invalid user admin from 218.55.193.136
Aug 4 04:10:24 localhost sshd[26743]: Invalid user admin from 218.55.193.136
Aug 4 04:10:26 localhost sshd[26745]: Invalid user user from 218.55.193.136
Aug 4 08:22:50 localhost sshd[30612]: Accepted keyboard-interactive/pam for rukie from 192.168.1.154 port 2364 ssh2
Aug 4 08:22:50 localhost sshd[30615]: pam_unix(sshd:session): session opened for user rukie by (uid=0)
Aug 4 08:23:01 localhost sshd[30615]: pam_unix(sshd:session): session closed for user rukie
Aug 4 08:46:32 localhost sshd[30655]: Accepted keyboard-interactive/pam for rukie from 192.168.1.154 port 2605 ssh2
Aug 4 08:46:32 localhost sshd[30658]: pam_unix(sshd:session): session opened for user rukie by (uid=0)
Aug 4 09:23:32 localhost sshd[30658]: pam_unix(sshd:session): session closed for user rukie
Aug 4 18:14:07 localhost sshd[10563]: Did not receive identification string from 220.232.151.15
Aug 4 18:22:05 localhost sshd[10687]: Invalid user staff from 220.232.151.15
Aug 4 18:22:08 localhost sshd[10689]: Invalid user sales from 220.232.151.15
Aug 4 18:22:10 localhost sshd[10692]: Invalid user recruit from 220.232.151.15
Aug 4 18:22:16 localhost sshd[10694]: Invalid user alias from 220.232.151.15
Aug 4 18:22:21 localhost sshd[10699]: Invalid user office from 220.232.151.15
Aug 4 18:42:18 localhost sudo: rukie : TTY=pts/0 ; PWD=/home/rukie/.giFT ; USER=root ; COMMAND=/bin/nano /etc/pam.d/sshd
Aug 4 18:47:32 localhost sudo: rukie : TTY=pts/0 ; PWD=/home/rukie/.giFT ; USER=root ; COMMAND=/bin/nano -w /etc/ssh/sshd_config
|
_________________
Gentoomania! Support the Open Source!
http://www.rukie.ath.cx |
|
| Back to top |
|
 |
danomac
l33t
Joined: 06 Nov 2004
Posts: 881
Location: Vancouver, BC
|
| Posted: Sun Aug 05, 2007 3:38 am Post subject: |
|
|
| This is why I use my firewall to map a different port than 22. I have it forward a really high port to port 22 on my LAN. |
|
| Back to top |
|
|
bunder
Bodhisattva
Joined: 10 Apr 2004
Posts: 5947
|
| Posted: Sun Aug 05, 2007 5:20 am Post subject: |
|
|
you might be interested in fail2ban.
_________________
| Neddyseagoon wrote: | | The problem with leaving is that you can only do it once and it reduces your influence. |
banned from #gentoo since sept 2017 |
|
| Back to top |
|
|
Vlad
Apprentice
Joined: 09 Apr 2002
Posts: 264
Location: San Diego, California
|
| Posted: Sun Aug 05, 2007 6:41 am Post subject: |
|
|
Meh, there's all sorts of ways to secure SSH and this sort of brute force attack isn't exactly uncommon.
Limiting the IP addresses that can connect to the port SSH is listening on, using a port other than 22, allowing only specific users/groups to login (via sshd_config), and using a script that auto-bans these brute force attacks are good ways to limit access.
I don't think that necessarily means NAT isn't secure. It just means you have to be careful when you're forwarding ports. I've suggested people buy a cheap linksys home router for years now as a means to secure their network. NAT is infinitely better than hooking your computer directly to the internet - especially if you ever use Windows. |
|
| Back to top |
|
|
magic919
Advocate
Joined: 17 Jun 2005
Posts: 2182
Location: Berkshire, UK
|
| Posted: Sun Aug 05, 2007 11:17 am Post subject: |
|
|
| Maybe we need a sticky entitled "If you open ports to the Internet you should expect people to drop by". |
|
| Back to top |
|
|
Rukie
l33t
Joined: 26 Jan 2004
Posts: 692
Location: SE Wi, Home of cheese and cowtippers.......
|
| Posted: Sun Aug 05, 2007 1:10 pm Post subject: |
|
|
Here's a description of my home network.
Cable Modem
|
Clark Connect PC (Nat)
|
Switch
|.................................|
Me......................Cisco Router (Second NAT)
.................................|
...........................Rest of Family
I have it setup in this way so that I can play around with ports/etc and use my home computer as sort of a server. I only have a few ports open/forwarded. ssh, a couple for giFT (which I still can't seem to get working).
I just setup fail2ban, but I'll be heading off to college, with 12,000 nerds or something at RIT, so I think I'm going to want to secure my pc even more. I'll have my wifi netgear router, but that'll be it.
So, any tips/suggestions would be great 
_________________
Gentoomania! Support the Open Source!
http://www.rukie.ath.cx |
|
| Back to top |
|
|
AdShea
n00b
Joined: 10 Mar 2005
Posts: 62
|
| Posted: Tue Aug 07, 2007 7:48 pm Post subject: |
|
|
Go grab shorewall (it's in portage) and setup a decent firewall, then be sure to only open what you absolutely need.
Use fail2ban or a similar program to help stop brute force attacks like what you've already seen. Possibly also add a rule that bans addresses that just tried to portscan you.
For the wireless, you have two choices. Either encrypt it with WPA2 which will discourage the casual wifi luser, or leave it open and have your compy do interesting things with unauthorized traffic. (Emails from their address to tell them to stop using your wifi for example)
If you leave it open, you'll want to do VPN so anyone with a card in rfmon can't grab what you're doing. Google driftnet for an example of what I mean here.
Other than that, be sure to use good passwords, and change them reasonably often (every month or so is usually good). Also, watch out for keyloggers when logging in on someone elses compy. ( My friend got me with that one  .) |
|
| Back to top |
|
|
redgsturbo
Apprentice
Joined: 24 Jun 2005
Posts: 283
|
| Posted: Tue Aug 07, 2007 8:12 pm Post subject: |
|
|
| Rukie wrote: | Here's a description of my home network.
Cable Modem
|
Clark Connect PC (Nat)
|
Switch
|.................................|
Me......................Cisco Router (Second NAT)
.................................|
...........................Rest of Family
I have it setup in this way so that I can play around with ports/etc and use my home computer as sort of a server. I only have a few ports open/forwarded. ssh, a couple for giFT (which I still can't seem to get working).
I just setup fail2ban, but I'll be heading off to college, with 12,000 nerds or something at RIT, so I think I'm going to want to secure my pc even more. I'll have my wifi netgear router, but that'll be it.
So, any tips/suggestions would be great |
Don't use wireless... many many drivers have an overflow condition in the beacon |
|
| Back to top |
|
|
eccerr0r
Watchman
Joined: 01 Jul 2004
Posts: 9882
Location: almost Mile High in the USA
|
| Posted: Tue Aug 07, 2007 8:14 pm Post subject: |
|
|
just wanted to reemphasize, if you have a port 22 open (or any common port open) you _WILL_ get scanned for services and people _WILL_ attack your machine regardless how meaningless your machine may be. Even people on dialup need to take precautions despite them not being as "valuable" as a 24/7 machine, but nevertheless still a great candidate for hacking.
So make sure everyone with an outward facing account has a good password (and pay special attention to root). I haven't started seeing what dictionary passwords the perpetrator is doing but I get scanned multiple times per day from all sorts of different machines. I think I'm up to around 1000 unique machines and I'm still getting more new machines prodding at mine... Botnet.
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching? |
|
| Back to top |
|
|
adsmith
Veteran
Joined: 26 Sep 2004
Posts: 1386
Location: NC, USA
|
| Posted: Tue Aug 07, 2007 9:04 pm Post subject: |
|
|
and configure it to block a host for 15 minutes after, say, 5 failed login attempts . It stops these brute force attacks and keeps your system logs clean... |
|
| Back to top |
|
|
transient
l33t
Joined: 13 Jan 2005
Posts: 759
|
| Posted: Tue Aug 07, 2007 10:13 pm Post subject: |
|
|
| lolscriptkiddies... |
|
| Back to top |
|
|
nrosier
n00b
Joined: 06 Jul 2002
Posts: 43
Location: Belgium
|
| Posted: Tue Aug 07, 2007 10:21 pm Post subject: |
|
|
| Or have a look at denyhosts. Blocks hosts in /etc/hosts.deny. Whitelisting, blacklisting, syncing ban-lists with servers etc... |
|
| Back to top |
|
|
Rukie
l33t
Joined: 26 Jan 2004
Posts: 692
Location: SE Wi, Home of cheese and cowtippers.......
|
| Posted: Tue Aug 07, 2007 10:57 pm Post subject: |
|
|
I'm interested in doing unique things with students who log into my wifi without asking....
Any suggestions on what proggies I need to do this?
Also, fail2ban doesn't seem to start at all, and it doesn't give any error. It just says it fails to start.
Also, for a VPN...is there really a safe way to do this?
I'll have 2 ethernet ports in my new dorm room
1 for me, 1 for roomate
so, should I have
Wall
|
Wireless Router
|..................|...................|
Me............Lappy............Strangers
(I'll defintely have wpa-psk enabled, however, even wpa is easily hacked, and I'm in a dorm full of nerds.)
I can also do
Wall
|
Main Comp
|
Wireless Router
|..................|
Lappy.......Strangers
the lappy could have a secure connection to the main comp, but still, its traffic load on my comp and then it would have to be on all the time (which I do now...)
_________________
Gentoomania! Support the Open Source!
http://www.rukie.ath.cx |
|
| Back to top |
|
|
im lost
n00b
Joined: 24 Jun 2007
Posts: 8
|
| Posted: Wed Aug 08, 2007 3:53 am Post subject: |
|
|
| Do you have iptables running? I didn't have that at first when I installed fail2ban, and then I didn't have it as part of the kernel. See this thread for my experience with that. |
|
| Back to top |
|
|
|
Networking & Security
