--- Suresh Ramasubramanian <[EMAIL PROTECTED]> wrote: > +++ Trevor Warren [linux-india] <03/07/02 13:22 > -0700>: > > Jul 1 15:36:54 paranux2 sshd[22124]: Did not > receive > > identification string from 164.77.202.146. [snip] thx suresh for the words of wisdom. Yesterday night @ 2:00AM....i as just browsing through the alerts generated.........nd was pretty much taken aback by the insane amounts of SSHing by lame crackers.
I hav 2 boxen..... --> 1 has only ssh open While the other has --> ssh + smtp(qmail) + pop(qmail) + imap(Courier) open I knwo abt the issues with Open SSH. Does it warrant an upgrade asap..??? Nyother precautionsto b taken. Trevor Warren > > OK fine... > > suresh (12:42:17 <~>) $ whois -h whois.geektools.com > 164.77.202.146 > Query: 164.77.202.146 > Registry: whois.arin.net > Results: > ISAPRE BANMEDICA (NET-BANMEDIC) BANMEDIC > 164.77.0.0 - 164.77.255.255 > ENTEL CHILE S.A. (NETBLK-ENTELCHILE-164-77) > ENTELCHILE-164-77 > 164.77.32.0 - 164.77.255.255 > > A Chilean ISP. Likely an open proxy or other > cracked box. > > > Jul 1 15:40:59 paranux2 sshd[22177]: Could not > reverse > > map address 61.11.13.154. > > This looks like Dishnet. > > suresh (12:43:50 <~>) $ whois -h whois.geektools.com > 61.11.13.154 > Query: 61.11.13.154 > Registry: whois.apnic.net > Results: > > % How to use the APNIC Whois Database > www.apnic.net/db/ > % Upgrade to Whois v3 on 20 August 2002 > www.apnic.net/whois-v3 > % Whois data copyright terms > www.apnic.net/db/dbcopyright.html > > inetnum: 61.11.0.0 - 61.11.31.255 > netname: DISHNET > descr: DISHNETDSL LTD > descr: 19, Cathedral Garden Road > descr: Nungambakkam > descr: CHENNAI > country: IN > admin-c: DIH1-AP > tech-c: DIH1-AP > mnt-by: APNIC-HM > mnt-lower: MAINT-IN-DISHNET > changed: [EMAIL PROTECTED] 20000321 > changed: [EMAIL PROTECTED] 20000927 > changed: [EMAIL PROTECTED] 20020612 > source: APNIC > > role: DISHNET IP Hostmaster > address: DishnetDSL Limited > address: 19, Cathedral Garden Road > address: Chennai, 600 034 > phone: +91-44-825 6201 > phone: +91-44-825 6149 > phone: +91-44-826 9801 > fax-no: +91-44-825 7477 > e-mail: [EMAIL PROTECTED] > trouble: Network abuse issues and SPAM > complaints > trouble: should be sent to [EMAIL PROTECTED] > admin-c: BR31-AP > tech-c: BR31-AP > nic-hdl: DIH1-AP > remarks: role object for Dishnet IP > Administrators > notify: [EMAIL PROTECTED] > mnt-by: MAINT-IN-DISHNET > changed: [EMAIL PROTECTED] 20020530 > source: APNIC > > Results brought to you by the GeekTools WHOIS Proxy > Server results may be copyrighted and are used with > permission. > Your host (202.77.223.2) has visited 3 times today. > > > I tried reverse lookin up this IP...but to no > avail. > > Not much point in trying it, when you have whois > (and failing that <- > courtesy old / stale / outdated records, stuff like > traceroute etc)? > > > No1 xcept me and 1 other admin knowz the passwd. > This > > may b a false alarm........but itz a serious 1. > > Can't see anything more than that someone tried to > ssh into your machine. > > > Jul 1 15:51:09 paranux2 sshd[22328]: Could not > reverse > > map address 61.11.13.154. > > Jul 1 15:51:11 paranux2 sshd[22328]: Accepted > password > > for ROOT from 61.11.13.154 port 62697 > > ... and succeeded, from this dishnet dsl IP. > > -srs > > -- > Suresh Ramasubramanian <----> mallet <at> efn dot > org > EMail Sturmbannfuhrer, Lower Middle Class Unix > Sysadmin > [Linux One Stanza Tip] From : <[EMAIL PROTECTED]> > LOST #128 -**< Sub : Monitoring internet traffic > >**- > Visit: http://pppstatus.sourceforge.net/download.htm > and down- > load the latest "PPPStatus". Edit /etc/inittab as > follows: > 7:23:respawn:/usr/local/bin/pppstatus > /dev/tty12 > This is a console program running on a free tty, > which will > give everything for ppp monitoring, including > telephone costs. > > > ------------------------------------------------------- > This sf.net email is sponsored by:ThinkGeek > Caffeinated soap. No kidding. > http://thinkgeek.com/sf > _______________________________________________ > linux-india-help mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/linux-india-help ===== ( >- GNU/LINUX, It's all about CHOICE -< ) /~\ __ http://www.qmailtheeasyway.com __ /~\ | \) / mailto: [EMAIL PROTECTED] \ (/ | |_|_ \ Project Manager, Linux/Unix. ZCL / _|_| \___________________________________/ __________________________________________________ Do You Yahoo!? Sign up for SBC Yahoo! Dial - First Month Free http://sbc.yahoo.com ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Caffeinated soap. No kidding. http://thinkgeek.com/sf _______________________________________________ linux-india-help mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/linux-india-help
