Re: sshd attack?

2001-08-15 Thread Philipp Schulte
On Wed, Aug 15, 2001 at 09:37:51AM +0200, Siegbert Baude wrote: I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected I got the same. Aug 14 11:46:44 nepomuk sshd[12166]:

Re: sshd attack?

2001-08-15 Thread Jörgen Persson
On Wed, Aug 15, 2001 at 09:37:51AM +0200, Siegbert Baude wrote: Hello, I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected What´s this? I do not know. How can I find out,

blocking an ip after n failed login attempts

2001-08-15 Thread David N Moore
Hi, I have been poking around with google looking for some ideas for a solution to this problem. Can you think of an easy way to block all connections from a certain ip if it tries log in say 5 times and fails? The idea being that it would stop someone from using a dictionary-based

Re: sshd attack?

2001-08-15 Thread Matthew Sackman
In fact why not just be really cruel: install the dtk (deception toolkit) - find it at all.net - and then watch the hackers think that they've found a vulnerable box and try to exploit it whilst you gather enough information about them to... [fill in as necessary]. Of course all the files that

The unwanted fish...

2001-08-15 Thread Martin Fluch
Hi! I know that this question was posted some time (some months) ago on this list (or debian-user), but I couldn't find the answer in the mailing list archives. I'm running unstable and (maybe) a month ago I spoted a fish swiming over my desktop from left to right, just a small one, just once.

Re: blocking an ip after n failed login attempts

2001-08-15 Thread Radu Florian
David N Moore wrote: Hi, I have been poking around with google looking for some ideas for a solution to this problem. Can you think of an easy way to block all connections from a certain ip if it tries log in say 5 times and fails? The idea being that it would stop someone from

AW: blocking an ip after n failed login attempts

2001-08-15 Thread Michael Boehme
Hmm... If it´s that what you were looking for, try route add -host ip gw 127.0.0.1 That´ll blackhole it and you won´t have to modify the file for that. Michael -Ursprüngliche Nachricht- Von: Radu Florian [mailto:[EMAIL PROTECTED]] Gesendet: Mittwoch, 15. August 2001 23:16 An: David

Re: The unwanted fish...

2001-08-15 Thread Bud Rogers
On Wednesday 15 August 2001 04:08 pm, Martin Fluch wrote: I'm running unstable and (maybe) a month ago I spoted a fish swiming over my desktop from left to right, just a small one, just once. Today again. Does anybody know where this fish is coming from? (I'm a little bit confused, since I

Re: The unwanted fish...

2001-08-15 Thread Craig Dickson
Martin Fluch wrote: I'm running unstable and (maybe) a month ago I spoted a fish swiming over my desktop from left to right, just a small one, just once. Today again. Does anybody know where this fish is coming from? (I'm a little bit confused, since I have never requested it and have no

Re: blocking an ip after n failed login attempts

2001-08-15 Thread Robert Magier
On Wed, 15 Aug 2001, David N Moore wrote: Hi, I have been poking around with google looking for some ideas for a solution to this problem. Can you think of an easy way to block all connections from a certain ip if it tries log in say 5 times and fails? The idea being that it would

Re: The unwanted fish...

2001-08-15 Thread James M. Cape
On 16 Aug 2001 00:08:48 +0300, Martin Fluch wrote: Hi! I know that this question was posted some time (some months) ago on this list (or debian-user), but I couldn't find the answer in the mailing list archives. I'm running unstable and (maybe) a month ago I spoted a fish swiming over

Re: blocking an ip after n failed login attempts

2001-08-15 Thread petong
On Wednesday 15 August 2001 11:21, David N Moore wrote: Hi, I have been poking around with google looking for some ideas for a solution to this problem. Can you think of an easy way to block all connections from a certain ip if it tries log in say 5 times and fails? The idea being

Re: The unwanted fish...

2001-08-15 Thread Wichert Akkerman
Previously Martin Fluch wrote: I'm running unstable and (maybe) a month ago I spoted a fish swiming over my desktop from left to right, just a small one, just once. Today again. I suspect you hit an easter egg in GNOME. Wichert. --

sshd attack?

2001-08-15 Thread Siegbert Baude
Hello, I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected What´s this? How can I find out, from where this attack is originating? Must I increase the verbositiy level of sshd to achieve

Re: sshd attack?

2001-08-15 Thread Philipp Schulte
On Wed, Aug 15, 2001 at 09:37:51AM +0200, Siegbert Baude wrote: I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected I got the same. Aug 14 11:46:44 nepomuk sshd[12166]: Disconnecting:

Re: sshd attack?

2001-08-15 Thread Jörgen Persson
On Wed, Aug 15, 2001 at 09:37:51AM +0200, Siegbert Baude wrote: Hello, I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected What´s this? I do not know. How can I find out, from

Re: Mutt and inline gpg

2001-08-15 Thread Alexey Vyskubov
/usr/share/doc/mutt/PGP-Notes.txt.gz I am using the same procmail filter and can say that it works perfectly for incoming pgp/gpg mails. However, this does not solve the problem with other mail clients that want to have inline PGP messages, and those are many. Is there a way to make mutt

blocking an ip after n failed login attempts

2001-08-15 Thread David N Moore
Hi, I have been poking around with google looking for some ideas for a solution to this problem. Can you think of an easy way to block all connections from a certain ip if it tries log in say 5 times and fails? The idea being that it would stop someone from using a dictionary-based

Re: sshd attack?

2001-08-15 Thread Matthew Sackman
In fact why not just be really cruel: install the dtk (deception toolkit) - find it at all.net - and then watch the hackers think that they've found a vulnerable box and try to exploit it whilst you gather enough information about them to... [fill in as necessary]. Of course all the files that

Re: sshd attack?

2001-08-15 Thread Philipp Schulte
On Wed, Aug 15, 2001 at 08:16:26PM +0100, Matthew Sackman wrote: In fact why not just be really cruel: install the dtk (deception toolkit) - find it at all.net - and then watch the hackers think that they've found a vulnerable box and try to exploit it whilst you gather enough information

The unwanted fish...

2001-08-15 Thread Martin Fluch
Hi! I know that this question was posted some time (some months) ago on this list (or debian-user), but I couldn't find the answer in the mailing list archives. I'm running unstable and (maybe) a month ago I spoted a fish swiming over my desktop from left to right, just a small one, just once.

Re: blocking an ip after n failed login attempts

2001-08-15 Thread Radu Florian
David N Moore wrote: Hi, I have been poking around with google looking for some ideas for a solution to this problem. Can you think of an easy way to block all connections from a certain ip if it tries log in say 5 times and fails? The idea being that it would stop someone from using

AW: blocking an ip after n failed login attempts

2001-08-15 Thread Michael Boehme
Hmm... If it´s that what you were looking for, try route add -host ip gw 127.0.0.1 That´ll blackhole it and you won´t have to modify the file for that. Michael -Ursprüngliche Nachricht- Von: Radu Florian [mailto:[EMAIL PROTECTED] Gesendet: Mittwoch, 15. August 2001 23:16 An: David N

Re: The unwanted fish...

2001-08-15 Thread Bud Rogers
On Wednesday 15 August 2001 04:08 pm, Martin Fluch wrote: I'm running unstable and (maybe) a month ago I spoted a fish swiming over my desktop from left to right, just a small one, just once. Today again. Does anybody know where this fish is coming from? (I'm a little bit confused, since I

Re: The unwanted fish...

2001-08-15 Thread Jonas bazz Egidius
From: Martin Fluch [EMAIL PROTECTED] I'm running unstable and (maybe) a month ago I spoted a fish swiming over my desktop from left to right, just a small one, just once. Today again. Does anybody know where this fish is coming from? (I'm a little bit confused, since I have never requested

Re: The unwanted fish...

2001-08-15 Thread Bud Rogers
On Wednesday 15 August 2001 04:08 pm, Martin Fluch wrote: I'm running unstable and (maybe) a month ago I spoted a fish swiming over my desktop from left to right, just a small one, just once. Today again. Does anybody know where this fish is coming from? (I'm a little bit confused, since I

Re: The unwanted fish...

2001-08-15 Thread Craig Dickson
Martin Fluch wrote: I'm running unstable and (maybe) a month ago I spoted a fish swiming over my desktop from left to right, just a small one, just once. Today again. Does anybody know where this fish is coming from? (I'm a little bit confused, since I have never requested it and have no

Re: blocking an ip after n failed login attempts

2001-08-15 Thread Robert Magier
On Wed, 15 Aug 2001, David N Moore wrote: Hi, I have been poking around with google looking for some ideas for a solution to this problem. Can you think of an easy way to block all connections from a certain ip if it tries log in say 5 times and fails? The idea being that it would

Re: The unwanted fish...

2001-08-15 Thread James M. Cape
On 16 Aug 2001 00:08:48 +0300, Martin Fluch wrote: Hi! I know that this question was posted some time (some months) ago on this list (or debian-user), but I couldn't find the answer in the mailing list archives. I'm running unstable and (maybe) a month ago I spoted a fish swiming over my

Re: blocking an ip after n failed login attempts

2001-08-15 Thread petong
On Wednesday 15 August 2001 11:21, David N Moore wrote: Hi, I have been poking around with google looking for some ideas for a solution to this problem. Can you think of an easy way to block all connections from a certain ip if it tries log in say 5 times and fails? The idea being