Fedora Users — Re: MORE SSH Hacking: heads-up

its korean

Most of us in *.au are seeing shitloads of it, not just ssh but telnet as well


On Fri, 30 Jul 2004, jludwig wrote:

On Fri, 2004-07-30 at 05:45, Brian Fahrlander wrote:

    From last night's LogWatch:
--------------------------------------------------------------------------

sshd:
   Invalid Users:
      Unknown Account: 7 Time(s)
   Unknown Entries:
      authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
rhost=johnstongrain.com  : 2 Time(s)
      authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
rhost=smms-mriley09d.chemistry.uq.edu.au  : 2 Time(s)
      authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
rhost=211.117.191.70  : 1 Time(s)
      authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
rhost=216.97.110.1  : 1 Time(s)
      authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser=
rhost=ccia-062-204-197-193.uned.es  : 1 Time(s)

su:
   Sessions Opened:
      brian(uid=500) -> root: 1 Time(s)

------------------------------------------------------------------------

    Ok, guys- what do we do with this?  Should we be writing down the
addresses from which these attempts were made? They're probably all
'stooge' addresses, I know, but it might help authorities to know what
other machines have been compromised...

    I'll go save the log somewhere...

------------------------------------------------------------------------

Search results for: 211.117.191.70
       OrgName:    Asia Pacific Network Information Centre
       OrgID:      APNIC
       Address:    PO Box 2131
       City:       Milton
       StateProv:  QLD
       PostalCode: 4064
       Country:    AU

       ReferralServer: whois://whois.apnic.net

       NetRange:   210.0.0.0 - 211.255.255.255
       CIDR:       210.0.0.0/7
       NetName:    APNIC-CIDR-BLK2
       NetHandle:  NET-210-0-0-0-1
       Parent:
       NetType:    Allocated to APNIC
       NameServer: NS1.APNIC.NET
       NameServer: NS3.APNIC.NET
       NameServer: NS4.APNIC.NET
       NameServer: NS.RIPE.NET
       NameServer: TINNIE.ARIN.NET
       NameServer: DNS1.TELSTRA.NET
       Comment:    This IP address range is not registered in the ARIN database.
       Comment:    For details, refer to the APNIC Whois Database via
       Comment:    WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
       Comment:    ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
       Comment:    for the Asia Pacific region. APNIC does not operate networks
       Comment:    using this IP address range and is not able to investigate
       Comment:    spam or abuse reports relating to these addresses. For more
       Comment:    help, refer to http://www.apnic.net/info/faq/abuse
       Comment:
       RegDate:    1996-07-01
       Updated:    2004-03-30

       OrgTechHandle: AWC12-ARIN
       OrgTechName:   APNIC Whois Contact
       OrgTechPhone:  +61 7 3858 3100
       OrgTechEmail:  search-apnic-not-arin@xxxxxxxxx

       # ARIN WHOIS database, last updated 2004-07-29 19:10
       # Enter ? for additional hints on searching ARIN's WHOIS database.

--
jludwig <wralphie@xxxxxxxxxxx>


--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list


--
Regards,
Res