+++ Trevor Warren [linux-india] <03/07/02 13:22 -0700>:
> Jul 1 15:36:54 paranux2 sshd[22124]: Did not receive
> identification string from 164.77.202.146.
OK fine...
suresh (12:42:17 <~>) $ whois -h whois.geektools.com 164.77.202.146
Query: 164.77.202.146
Registry: whois.arin.net
Results:
ISAPRE BANMEDICA (NET-BANMEDIC) BANMEDIC 164.77.0.0 - 164.77.255.255
ENTEL CHILE S.A. (NETBLK-ENTELCHILE-164-77) ENTELCHILE-164-77
164.77.32.0 - 164.77.255.255
A Chilean ISP. Likely an open proxy or other cracked box.
> Jul 1 15:40:59 paranux2 sshd[22177]: Could not reverse
> map address 61.11.13.154.
This looks like Dishnet.
suresh (12:43:50 <~>) $ whois -h whois.geektools.com 61.11.13.154
Query: 61.11.13.154
Registry: whois.apnic.net
Results:
% How to use the APNIC Whois Database www.apnic.net/db/
% Upgrade to Whois v3 on 20 August 2002 www.apnic.net/whois-v3
% Whois data copyright terms www.apnic.net/db/dbcopyright.html
inetnum: 61.11.0.0 - 61.11.31.255
netname: DISHNET
descr: DISHNETDSL LTD
descr: 19, Cathedral Garden Road
descr: Nungambakkam
descr: CHENNAI
country: IN
admin-c: DIH1-AP
tech-c: DIH1-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-IN-DISHNET
changed: [EMAIL PROTECTED] 20000321
changed: [EMAIL PROTECTED] 20000927
changed: [EMAIL PROTECTED] 20020612
source: APNIC
role: DISHNET IP Hostmaster
address: DishnetDSL Limited
address: 19, Cathedral Garden Road
address: Chennai, 600 034
phone: +91-44-825 6201
phone: +91-44-825 6149
phone: +91-44-826 9801
fax-no: +91-44-825 7477
e-mail: [EMAIL PROTECTED]
trouble: Network abuse issues and SPAM complaints
trouble: should be sent to [EMAIL PROTECTED]
admin-c: BR31-AP
tech-c: BR31-AP
nic-hdl: DIH1-AP
remarks: role object for Dishnet IP Administrators
notify: [EMAIL PROTECTED]
mnt-by: MAINT-IN-DISHNET
changed: [EMAIL PROTECTED] 20020530
source: APNIC
Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.
Your host (202.77.223.2) has visited 3 times today.
> I tried reverse lookin up this IP...but to no avail.
Not much point in trying it, when you have whois (and failing that <-
courtesy old / stale / outdated records, stuff like traceroute etc)?
> No1 xcept me and 1 other admin knowz the passwd. This
> may b a false alarm........but itz a serious 1.
Can't see anything more than that someone tried to ssh into your machine.
> Jul 1 15:51:09 paranux2 sshd[22328]: Could not reverse
> map address 61.11.13.154.
> Jul 1 15:51:11 paranux2 sshd[22328]: Accepted password
> for ROOT from 61.11.13.154 port 62697
... and succeeded, from this dishnet dsl IP.
-srs
--
Suresh Ramasubramanian <----> mallet <at> efn dot org
EMail Sturmbannfuhrer, Lower Middle Class Unix Sysadmin
[Linux One Stanza Tip] From : <[EMAIL PROTECTED]>
LOST #128 -**< Sub : Monitoring internet traffic >**-
Visit: http://pppstatus.sourceforge.net/download.htm and down-
load the latest "PPPStatus". Edit /etc/inittab as follows:
7:23:respawn:/usr/local/bin/pppstatus > /dev/tty12
This is a console program running on a free tty, which will
give everything for ppp monitoring, including telephone costs.
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Caffeinated soap. No kidding.
http://thinkgeek.com/sf
_______________________________________________
linux-india-help mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/linux-india-help
