On Fri, 04 Mar 2005 05:49:08 -0500, sandeep shivasharan
<[EMAIL PROTECTED]> wrote:
> hi all,
>
> attaching herewith the log details, where i could see a lot number of
> unauthenticated users accessing my RedHat Linux 9 Box. where in i don't have
> any firewall install except IPTABLES that to with forwarding entries for
> internet access users from my own network.
>
> what input policies should i apply to stop such attack and any other relevant
> attack from within IPTABLES ???
>
> THANKS,
> Sandeep
>
> /var/log/secure
>
> Mar 3 08:03:39 sshd(pam_unix)[23082]: authentication failure; logname= uid=0
> euid=0 tty=NODEVssh ruser= rhost=adsl-67-124-86-74.dsl.pltn13.pacbell.net
> user=operator
> Mar 3 08:03:44 sshd(pam_unix)[23084]: authentication failure; logname= uid=0
> euid=0 tty=NODEVssh ruser= rhost=adsl-67-124-86-74.dsl.pltn13.pacbell.net
> user=adm
> Mar 3 08:03:49 sshd(pam_unix)[23086]: authentication failure; logname= uid=0
> euid=0 tty=NODEVssh ruser= rhost=adsl-67-124-86-74.dsl.pltn13.pacbell.net
> user=apache
> Mar 3 08:04:00 sshd(pam_unix)[23092]: authentication failure; logname= uid=0
> euid=0 tty=NODEVssh ruser= rhost=adsl-67-124-86-74.dsl.pltn13.pacbell.net
> user=adm
> Mar 3 08:04:05 sshd(pam_unix)[23094]: authentication failure; logname= uid=0
> euid=0 tty=NODEVssh ruser= rhost=adsl-67-124-86-74.dsl.pltn13.pacbell.net
> user=root
> Mar 3 16:21:53 sshd(pam_unix)[24766]: authentication failure; logname= uid=0
> euid=0 tty=NODEVssh ruser= rhost=203.194.221.183 user=root
> Mar 3 16:21:53 sshd(pam_unix)[24768]: authentication failure; logname= uid=0
> euid=0 tty=NODEVssh ruser= rhost=203.194.221.183 user=root
> Mar 3 16:21:59 sshd(pam_unix)[24770]: authentication failure; logname= uid=0
> euid=0 tty=NODEVssh ruser= rhost=203.194.221.183 user=root
Hello sandeep,
Maybe using tcpwrappers to block your ssh to all except your
internal network might be helpful.
Just add the following line to your /etc/hosts.deny file :
sshd : ALL EXCEPT LOCAL, 192.168.0.0/255.255.255.0
You may change the network IP in the above line to your network. You
can also give a domain name like ( .xyz.com)
On the other hand, you can use IPtables to deny access to such
intruders by first using a default policy of DROP:
# iptables -P INPUT DROP
And then only allowing those that you really need to give access to.
Hope this helps
regards
Ravi
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
linux-india-help mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-india-help
