From owner-freebsd-questions@FreeBSD.ORG Wed Aug 24 04:22:35 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 887AB16A41F for ; Wed, 24 Aug 2005 04:22:35 +0000 (GMT) (envelope-from ricking505@yahoo.com) Received: from web34103.mail.mud.yahoo.com (web34103.mail.mud.yahoo.com [66.163.178.101]) by mx1.FreeBSD.org (Postfix) with SMTP id 0DB2C43D48 for ; Wed, 24 Aug 2005 04:22:34 +0000 (GMT) (envelope-from ricking505@yahoo.com) Received: (qmail 12262 invoked by uid 60001); 24 Aug 2005 04:22:34 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=EUhBkYd8f436yFMm5gtmN39bTc/7PqfqcORqmbO8VhzkbFGYvksRvvfST28V6JbW0n1rOlErNrQp5v/K3+UMP61wn6B6ArFwlWTW5XqArh9sFoVwRHa9YXkzUuLae3z5tBB+NVor72FtByOWONT6cCQ4ypmu1kWqoaydhJPmNTw= ; Message-ID: <20050824042234.12260.qmail@web34103.mail.mud.yahoo.com> Received: from [69.180.61.238] by web34103.mail.mud.yahoo.com via HTTP; Tue, 23 Aug 2005 21:22:34 PDT Date: Tue, 23 Aug 2005 21:22:34 -0700 (PDT) From: ro ro To: freebsd-questions@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Subject: Illegal access attempt - FreeBSD 5.4 Release - please advise X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Aug 2005 04:22:35 -0000 Hi All, I was browsing through my log files and noticed that someone (or many people) is trying to gain illegal access to my server (see snippet from log files below). The below log file clearly indicates someone trying to hackaway at my personal server. I performed the following steps: nmap -v 210.0.142.153 and noticed that this person/institution had port 80 and 21 open. I visited their website and it appears to be someone from hongkong. http://www.chkpcc.edu.hk/ HERE IS THEIR CONTACT INFORMATION AS IT APPEARS ON THEIR WEBSITE ------------------------------------------------------------- Confucian Ho Kwok Pui Chun College 孔 教 學 院 何 郭 佩 珍 中 學 Address 地址： Fu Shin Est., Taipo, N.T., HKSAR 香港新界大埔富善村 Tel 電話： 852-2666-5926 Fax 傳真： 852-2660-7988 E-mail 電郵： info@chkpcc.edu.hk ------------------------------------------------------------- When I saw the logs for the first time. I took the following steps: 1) AllowUsers in sshd contained only users that I wanted to have access to my ssh 2) Created a decent rulest within ipfw that permitted incoming access to only two ports ssh and http I took the issue of creating a good firewall quite lightly and now I regret that decision.. now I have learnt... Can someone provide me with guidance on this issue and advise me on next steps to take action against such losers. Thanks RV Aug 23 08:19:03 free sshd[22519]: Illegal user lp from 210.0.142.153 Aug 23 08:19:06 free sshd[22521]: Illegal user admin from 210.0.142.153 Aug 23 08:19:08 free sshd[22523]: Illegal user admin from 210.0.142.153 Aug 23 08:19:10 free sshd[22525]: Illegal user admin from 210.0.142.153 Aug 23 08:19:12 free sshd[22527]: Illegal user admin from 210.0.142.153 Aug 23 08:19:15 free sshd[22529]: Illegal user admin from 210.0.142.153 Aug 23 08:19:17 free sshd[22531]: Illegal user admin from 210.0.142.153 Aug 23 08:19:19 free sshd[22533]: Illegal user admin from 210.0.142.153 Aug 23 08:19:22 free sshd[22535]: User root not allowed because not listed in AllowUsers Aug 23 08:19:24 free sshd[22537]: User root not allowed because not listed in AllowUsers Aug 23 08:19:27 free sshd[22539]: User root not allowed because not listed in AllowUsers Aug 23 08:19:29 free sshd[22541]: User root not allowed because not listed in AllowUsers Aug 23 08:19:33 free sshd[22543]: User root not allowed because not listed in AllowUsers Aug 23 08:19:35 free sshd[22545]: User root not allowed because not listed in AllowUsers Aug 23 08:19:37 free sshd[22547]: Illegal user apache from 210.0.142.153 Aug 23 08:19:40 free sshd[22549]: Illegal user dan from 210.0.142.153 Aug 23 08:19:42 free sshd[22551]: Illegal user electra from 210.0.142.153 Aug 23 08:19:44 free sshd[22553]: Illegal user student from 210.0.142.153 Aug 23 08:19:47 free sshd[22555]: Illegal user school from 210.0.142.153 Aug 23 08:19:49 free sshd[22557]: User mysql not allowed because not listed in AllowUsers Aug 11 20:16:10 free sshd[21585]: Illegal user test from 210.245.197.16 Aug 11 20:16:12 free sshd[21587]: Illegal user guest from 210.245.197.16 Aug 11 20:16:14 free sshd[21589]: Illegal user admin from 210.245.197.16 Aug 11 20:16:16 free sshd[21591]: Illegal user admin from 210.245.197.16 Aug 11 20:16:23 free sshd[21593]: Illegal user user from 210.245.197.16 Aug 11 20:16:32 free sshd[21601]: Illegal user test from 210.245.197.16 Aug 14 03:39:21 free sshd[32377]: Illegal user 1 from 61.145.222.10 Aug 14 03:39:26 free sshd[32379]: Illegal user a from 61.145.222.10 Aug 14 03:39:31 free sshd[32381]: Illegal user a from 61.145.222.10 Aug 14 03:39:38 free sshd[32383]: Illegal user abuse from 61.145.222.10 Aug 14 10:47:49 free sshd[33623]: Illegal user admin from 64.222.146.197 Aug 14 10:47:51 free sshd[33625]: Illegal user administrator from 64.222.146.197 Aug 14 10:47:52 free sshd[33627]: Illegal user jack from 64.222.146.197 Aug 14 10:47:53 free sshd[33629]: Illegal user marvin from 64.222.146.197 Aug 14 10:47:58 free sshd[33631]: Illegal user andres from 64.222.146.197 Aug 14 10:47:59 free sshd[33633]: Illegal user barbara from 64.222.146.197 Aug 14 10:48:01 free sshd[33635]: Illegal user adine from 64.222.146.197 Aug 14 10:48:02 free sshd[33637]: Illegal user test from 64.222.146.197 Aug 14 10:48:04 free sshd[33639]: Illegal user guest from 64.222.146.197 Aug 14 10:48:07 free sshd[33641]: Illegal user db from 64.222.146.197 Aug 23 08:18:40 free sshd[22499]: Illegal user demo from 210.0.142.153 Aug 23 08:18:43 free sshd[22501]: Illegal user postgres from 210.0.142.153 Aug 23 08:18:45 free sshd[22503]: Illegal user postmaster from 210.0.142.153 Aug 23 08:18:47 free sshd[22505]: Illegal user postgres from 210.0.142.153 Aug 23 08:18:49 free sshd[22507]: Illegal user postgres from 210.0.142.153 Aug 23 08:18:52 free sshd[22509]: Illegal user ftp from 210.0.142.153 Aug 23 08:18:54 free sshd[22511]: User news not allowed because not listed in AllowUsers Aug 23 08:18:56 free sshd[22513]: Illegal user demo from 210.0.142.153 Aug 23 08:18:58 free sshd[22515]: Illegal user demouser from 210.0.142.153 Aug 23 08:19:01 free sshd[22517]: User sshd not allowed because not listed in AllowUsers __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com