On Fri, 2004-07-30 at 14:17, Jenkins, Jeremiah wrote:
Not /etc/secure , /var/log/secure....man, I can tell it's friday
This was in my logs last night at 11.56pm.
Aug 1 23:56:28 neuromancer sshd[22962]: Illegal user test from 203.185.29.89
Aug 1 23:56:30 neuromancer sshd[22962]: Failed password for illegal user test from
203.185.29.89 port 40688 ssh2
Aug 1 23:56:34 neuromancer sshd[23055]: Illegal user guest from 203.185.29.89
Aug 1 23:56:37 neuromancer sshd[23055]: Failed password for illegal user guest from
203.185.29.89 port 40779 ssh2
whois returned it as a ISP in Hong Kong.
-----Original Message-----
From: Jenkins, Jeremiah [mailto:jeremiah.jenkins@neustar.biz]
Sent: Friday, July 30, 2004 5:16 PM
To: 'For users of Fedora Core releases'
Subject: RE: MORE SSH Hacking: heads-up
What does your /etc/secure log say?
There are some scripts around the internet now, where they try to log in via
ssh using "test" and guest with sometimes an admin account
-----Original Message-----
From: jludwig [mailto:wralphie@comcast.net]
Sent: Friday, July 30, 2004 4:12 PM
To: For users of Fedora Core releases
Subject: Re: MORE SSH Hacking: heads-up
On Fri, 2004-07-30 at 05:45, Brian Fahrlander wrote:
> From last night's LogWatch:
> --------------------------------------------------------------------------
>
> sshd:
> Invalid Users:
> Unknown Account: 7 Time(s)
> Unknown Entries:
> authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
>
rhost=johnstongrain.com : 2 Time(s)
> authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
> rhost=smms-mriley09d.chemistry.uq.edu.au : 2 Time(s)
> authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
> rhost=211.117.191.70 : 1 Time(s)
> authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
> rhost=216.97.110.1 : 1 Time(s)
> authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
> rhost=ccia-062-204-197-193.uned.es : 1 Time(s)
>
> su:
> Sessions Opened:
> brian(uid=500) -> root: 1 Time(s)
>
> ------------------------------------------------------------------------
>
> Ok, guys- what do we do with this? Should we be writing down the
> addresses from which these attempts were made? They're probably all
> 'stooge' addresses, I know, but it might help authorities to know what
> other machines have been compromised...
>
> I'll go save the log somewhere...
>
> ------------------------------------------------------------------------
Search results for: 211.117.191.70
OrgName: Asia Pacific Network Information Centre
OrgID: APNIC
Address: PO Box 2131
City: Milton
StateProv: QLD
PostalCode: 4064
Country: AU
ReferralServer:
whois://whois.apnic.net
NetRange: 210.0.0.0 - 211.255.255.255
CIDR: 210.0.0.0/7
NetName: APNIC-CIDR-BLK2
NetHandle: NET-210-0-0-0-1
Parent:
NetType: Allocated to APNIC
NameServer:
NS1.APNIC.NET
NameServer:
NS3.APNIC.NET
NameServer:
NS4.APNIC.NET
NameServer:
NS.RIPE.NET
NameServer:
TINNIE.ARIN.NET
NameServer:
DNS1.TELSTRA.NET
Comment: This IP address range is not registered in the ARIN
database.
Comment: For details, refer to the APNIC Whois Database via
Comment:
WHOIS.APNIC.NET or
http://www.apnic.net/apnic-bin/whois2.pl
Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet
Registry
Comment: for the Asia Pacific region. APNIC does not operate
networks
Comment: using this IP address range and is not able to
investigate
Comment: spam or abuse reports relating to these addresses. For
more
Comment: help, refer to
http://www.apnic.net/info/faq/abuse
Comment:
RegDate: 1996-07-01
Updated: 2004-03-30
OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: +61 7 3858 3100
OrgTechEmail: search-apnic-not-arin(a)apnic.net
# ARIN WHOIS database, last updated 2004-07-29 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
--
jludwig <wralphie(a)comcast.net>
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe:
http://www.redhat.com/mailman/listinfo/fedora-list
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe:
http://www.redhat.com/mailman/listinfo/fedora-list
--
Ow Mun Heng
Fedora GNU/Linux Core 2 on D600 1.4Ghz CPU kernel
2.6.7-2.jul1-interactive
Neuromancer 12:19:27 up 3:38, 5 users, load average: 1.71, 1.38, 1.25