From owner-freebsd-security@FreeBSD.ORG Sat Sep 18 12:33:00 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D3ED716A4CE for ; Sat, 18 Sep 2004 12:33:00 +0000 (GMT) Received: from boleskine.patpro.net (boleskine.patpro.net [62.4.20.155]) by mx1.FreeBSD.org (Postfix) with ESMTP id 40D2443D45 for ; Sat, 18 Sep 2004 12:33:00 +0000 (GMT) (envelope-from patpro@patpro.net) Received: from localhost (localhost.patpro.net [127.0.0.1]) by boleskine.patpro.net (Postfix) with ESMTP id BDE1D7FB; Sat, 18 Sep 2004 14:32:58 +0200 (CEST) Received: from boleskine.patpro.net ([127.0.0.1]) by localhost (boleskine.patpro.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 31108-02; Sat, 18 Sep 2004 14:32:52 +0200 (CEST) Received: from [192.168.0.1] (cassandre [192.168.0.1]) by boleskine.patpro.net (Postfix) with ESMTP id 83DC5AB; Sat, 18 Sep 2004 14:32:51 +0200 (CEST) Mime-Version: 1.0 (Apple Message framework v619) In-Reply-To: <414C2798.7060509@withagen.nl> References: <414C2798.7060509@withagen.nl> Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Patrick Proniewski Date: Sat, 18 Sep 2004 14:32:50 +0200 To: Willem Jan Withagen , Liste FreeBSD-security X-Mailer: Apple Mail (2.619) X-Virus-Scanned: by amavisd-new at patpro.net Subject: Re: Attacks on ssh port X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Sep 2004 12:33:00 -0000 On 18 sept. 2004, at 14:18, Willem Jan Withagen wrote: > Hi, > > Is there a security problem with ssh that I've missed??? > Ik keep getting these hords of: Failed password for root from > 69.242.5.195 port 39239 ssh2 > with all kinds of different source addresses. > > They have a shot or 15 and then they are of again, but a little later > on they're back and keep clogging my logs. > Is there a "easy" way of getting these ip-numbers added to the > blocking-list of ipfw?? not a ssh related problem, it's just a brute force attack, I'm experiencing this on every servers I have, more than 10 times a day. I'm really thinking about releasing the list of attackers IP to the public. As far as I know, it's a pack of compromised machines. patpro