Date: Sat, 22 Oct 2011 10:56:31 -0600 From: Eric S Pulley <pulley@dabus.com> To: freebsd-questions@freebsd.org Subject: Re: Breakin attempt Message-ID: <544D62C65A99325660F7D6D3@alcor.dabus.com> In-Reply-To: <000001cc90c0$a0c16050$e24420f0$@org> References: <000001cc90c0$a0c16050$e24420f0$@org>
next in thread | previous in thread | raw e-mail | index | archive | help
Actually this looks like fairly normal white noise you can expect on a
public facing ssh server. There are a lot of bots out there, looking for
another box to own. If you're running PF put in something like the
following.
block in quick log from {<BADGUYS>}
.
.
.
pass in log on $ext_if proto tcp to ($ext_if) port { ssh } \
flags S/SA modulate state \
(max-src-conn-rate 3/60, overload <BADGUYS> flush global)
And remember that that you need to wait a minute if you (for some reason)
make more than x (3 in this case) connections from the same source in a
minutes time. Tune as needed.
The disable root logins and only use keys if you can, strong PWs if you
can't and you should be good.
--On Saturday, October 22, 2011 03:43:44 PM +0200 Admin ValhallaProjectet
<admin@thorshammare.org> wrote:
> Hello all
>
>
>
> FreeBSD odin.thorshammare.org 8.2-STABLE FreeBSD 8.2-STABLE #0: Sat Oct 22
> 10:14:48 CEST 2011
> hasse@odin.thorshammare.org:/usr/obj/usr/src/sys/ODIN i386
>
> Firewall PF.
>
> Blocking China and some other related countries in that region.
> Disabled ssh root logins
>
>
>
> Apparently, I'm under some kind of attack, for the last 3 days.
>
> Lots of attempts to ssh in as root from many different IP addresses.
>
> No bruteforce attempts.
>
> This just puzzles me. Using all these resources ? To achieve what ?
>
> Below is a one hour snip from my auth.log
>
> Nothing unusual in pflog
>
> Appreciate all ideas of how to proceed with this mather.
>
>
>
> Best regards Hasse
>
>
>
> Oct 22 12:00:19 odin sshd[14359]: error: PAM: authentication error for
> root from server.fabian.cz
>
> Oct 22 12:01:08 odin sshd[14365]: Address 87.105.187.194 maps to
> client-arsmedica-2.wroclaw.dialog.net.pl, but this does not map back to
> the address - POSSIBLE BREAK-IN ATTEMPT!
>
> Oct 22 12:01:09 odin sshd[14365]: error: PAM: authentication error for
> root from 87.105.187.194
>
> Oct 22 12:02:59 odin sshd[14422]: error: PAM: authentication error for
> root from 87.229.7.163
>
> Oct 22 12:03:36 odin sshd[14865]: error: PAM: authentication error for
> root from 201.25.53.34
>
> Oct 22 12:03:53 odin sshd[15571]: error: PAM: authentication error for
> root from 109.237.210.147
>
> Oct 22 12:05:18 odin sshd[18357]: error: PAM: authentication error for
> root from 12.222.202.34
>
> Oct 22 12:05:36 odin sshd[18375]: error: PAM: authentication error for
> root from mx.aysor.am
>
> Oct 22 12:05:53 odin sshd[18537]: error: PAM: authentication error for
> root from 190.129.11.76
>
> Oct 22 12:07:06 odin sshd[19429]: Address 80.188.13.214 maps to
> www.profitaxi.cz, but this does not map back to the address - POSSIBLE
> BREAK-IN ATTEMPT!
>
> Oct 22 12:07:06 odin sshd[19429]: error: PAM: authentication error for
> root from 80.188.13.214
>
> Oct 22 12:07:27 odin sshd[19542]: error: PAM: authentication error for
> root from 85.185.180.48
>
> Oct 22 12:08:05 odin sshd[19591]: error: PAM: authentication error for
> root from 208.125.137.121
>
> Oct 22 12:09:45 odin sshd[19629]: error: PAM: authentication error for
> root from 83.14.240.10
>
> Oct 22 12:10:53 odin sshd[19699]: error: PAM: authentication error for
> root from 200.160.121.246
>
> Oct 22 12:10:59 odin sshd[19702]: error: PAM: authentication error for
> root from 151.1.183.216
>
> Oct 22 12:11:38 odin sshd[19787]: error: PAM: authentication error for
> root from crm.nepinc.com
>
> Oct 22 12:12:16 odin sshd[19830]: error: PAM: authentication error for
> root from 189.16.12.146
>
> Oct 22 12:12:45 odin sshd[19843]: error: PAM: authentication error for
> root from narro.uaaan.mx
>
> Oct 22 12:14:14 odin sshd[19913]: error: PAM: authentication error for
> root from 217.128.151.181
>
> Oct 22 12:14:56 odin sshd[19925]: reverse mapping checking getaddrinfo for
> panda.zsuvoz.cz [195.178.81.116] failed - POSSIBLE BREAK-IN ATTEMPT!
>
> Oct 22 12:14:56 odin sshd[19925]: error: PAM: authentication error for
> root from 195.178.81.116
>
> Oct 22 12:16:14 odin sshd[19995]: error: PAM: authentication error for
> root from 87.193.246.26
>
> Oct 22 12:16:23 odin sshd[20008]: error: PAM: authentication error for
> root from 219.94.144.230
>
> Oct 22 12:16:39 odin sshd[20026]: error: PAM: authentication error for
> root from 82.130.143.216
>
> Oct 22 12:17:41 odin sshd[20073]: error: PAM: authentication error for
> root from 87.193.246.26
>
> Oct 22 12:17:52 odin sshd[20102]: error: PAM: authentication error for
> root from 82.130.143.216
>
> Oct 22 12:21:16 odin sshd[20268]: error: PAM: authentication error for
> root from 203.141.158.120
>
> Oct 22 12:21:34 odin sshd[20286]: error: PAM: authentication error for
> root from 208.125.137.121
>
> Oct 22 12:22:05 odin sshd[20326]: reverse mapping checking getaddrinfo for
> 86-100-134-185-ip.balticum.lt [86.100.134.185] failed - POSSIBLE BREAK-IN
> ATTEMPT!
>
> Oct 22 12:22:05 odin sshd[20326]: error: PAM: authentication error for
> root from 86.100.134.185
>
> Oct 22 12:22:22 odin sshd[20339]: error: PAM: authentication error for
> root from 201.232.69.113
>
> Oct 22 12:23:35 odin sshd[20428]: error: PAM: authentication error for
> root from 87.229.7.163
>
> Oct 22 12:23:58 odin sshd[20486]: error: PAM: authentication error for
> root from 65.161.248.26
>
> Oct 22 12:24:39 odin sshd[20605]: error: PAM: authentication error for
> root from 210.238.91.147
>
> Oct 22 12:25:08 odin sshd[21400]: error: PAM: authentication error for
> root from 12.222.202.34
>
> Oct 22 12:26:08 odin sshd[23744]: error: PAM: authentication error for
> root from zodiaq3d.info
>
> Oct 22 12:26:56 odin sshd[23747]: error: PAM: authentication error for
> root from mx.cbc-group.kz
>
> Oct 22 12:30:26 odin sshd[23752]: error: PAM: authentication error for
> root from 190.152.145.53
>
> Oct 22 12:30:54 odin sshd[23757]: error: PAM: authentication error for
> root from 80.24.95.85
>
> Oct 22 12:30:59 odin sshd[23759]: error: PAM: authentication error for
> root from 200.183.172.2
>
> Oct 22 12:31:13 odin sshd[23755]: error: PAM: authentication error for
> root from starless.com.pl
>
> Oct 22 12:31:38 odin sshd[23764]: error: PAM: authentication error for
> root from 61.19.252.236
>
> Oct 22 12:32:21 odin sshd[23767]: error: PAM: authentication error for
> root from 109.237.210.147
>
> Oct 22 12:32:29 odin sshd[23770]: error: PAM: authentication error for
> root from 65.82.69.5
>
> Oct 22 12:33:36 odin sshd[23785]: Address 161.200.90.2 maps to
> dsprl.eng.chula.ac.th, but this does not map back to the address -
> POSSIBLE BREAK-IN ATTEMPT!
>
> Oct 22 12:33:37 odin sshd[23785]: error: PAM: authentication error for
> root from 161.200.90.2
>
> Oct 22 12:34:48 odin sshd[23788]: error: PAM: authentication error for
> root from 83.139.194.70
>
> Oct 22 12:35:46 odin sshd[23793]: error: PAM: authentication error for
> root from 61.19.45.119
>
> Oct 22 12:36:20 odin sshd[23796]: reverse mapping checking getaddrinfo for
> nat-div.azores.gov.pt [83.240.154.46] failed - POSSIBLE BREAK-IN ATTEMPT!
>
> Oct 22 12:36:21 odin sshd[23796]: error: PAM: authentication error for
> root from 83.240.154.46
>
> Oct 22 12:36:56 odin sshd[23799]: error: PAM: authentication error for
> root from 109.237.210.147
>
> Oct 22 12:37:06 odin sshd[23802]: error: PAM: authentication error for
> root from supermodels.com
>
> Oct 22 12:38:45 odin sshd[23805]: error: PAM: authentication error for
> root from 193.77.58.207
>
> Oct 22 12:39:04 odin sshd[23808]: error: PAM: authentication error for
> root from 80.26.69.233
>
> Oct 22 12:40:53 odin sshd[23813]: error: PAM: authentication error for
> root from www.iitkgp.ac.in
>
> Oct 22 12:43:47 odin sshd[24680]: error: PAM: authentication error for
> root from 213.195.75.188
>
> Oct 22 12:44:20 odin sshd[24697]: error: PAM: authentication error for
> root from 99.13.226.154
>
> Oct 22 12:45:05 odin sshd[24730]: error: PAM: authentication error for
> root from bk19.com
>
> Oct 22 12:45:52 odin sshd[24738]: error: PAM: authentication error for
> root from 91.191.170.146
>
> Oct 22 12:46:01 odin sshd[24735]: error: PAM: authentication error for
> root from 81.56.57.50
>
> Oct 22 12:46:15 odin sshd[24743]: error: PAM: authentication error for
> root from 217.128.151.181
>
> Oct 22 12:46:27 odin sshd[24746]: reverse mapping checking getaddrinfo for
> z-atman-ett.net.pl [193.111.37.122] failed - POSSIBLE BREAK-IN ATTEMPT!
>
> Oct 22 12:46:28 odin sshd[24746]: error: PAM: authentication error for
> root from 193.111.37.122
>
> Oct 22 12:47:33 odin sshd[24749]: error: PAM: authentication error for
> root from 202.28.37.63
>
> Oct 22 12:48:34 odin sshd[24752]: error: PAM: authentication error for
> root from 189.19.13.239
>
> Oct 22 12:49:38 odin sshd[24755]: error: PAM: authentication error for
> root from 82.228.250.163
>
> Oct 22 12:49:46 odin sshd[24758]: reverse mapping checking getaddrinfo for
> customer-201-134-39-146.uninet-ide.com.mx [201.134.39.146] failed -
> POSSIBLE BREAK-IN ATTEMPT!
>
> Oct 22 12:49:46 odin sshd[24758]: error: PAM: authentication error for
> root from 201.134.39.146
>
> Oct 22 12:49:57 odin sshd[24761]: reverse mapping checking getaddrinfo for
> 138-65-162-69.reverse.lstn.net [69.162.65.138] failed - POSSIBLE BREAK-IN
> ATTEMPT!
>
> Oct 22 12:49:57 odin sshd[24761]: error: PAM: authentication error for
> root from 69.162.65.138
>
> Oct 22 12:50:15 odin sshd[24770]: error: PAM: authentication error for
> root from 217.128.151.181
>
> Oct 22 12:53:04 odin sshd[24774]: reverse mapping checking getaddrinfo for
> 86-100-134-185-ip.balticum.lt [86.100.134.185] failed - POSSIBLE BREAK-IN
> ATTEMPT!
>
> Oct 22 12:53:04 odin sshd[24774]: error: PAM: authentication error for
> root from 86.100.134.185
>
> Oct 22 12:53:28 odin sshd[24781]: error: PAM: authentication error for
> root from 12.222.202.34
>
> Oct 22 12:53:31 odin sshd[24784]: error: PAM: authentication error for
> root from 109.237.210.147
>
> Oct 22 12:55:19 odin sshd[24801]: error: PAM: authentication error for
> root from 87.193.246.26
>
> Oct 22 12:55:51 odin sshd[24804]: error: PAM: authentication error for
> root from 219.94.144.230
>
> Oct 22 12:56:24 odin sshd[24807]: error: PAM: authentication error for
> root from 213.192.8.22
>
> Oct 22 12:56:28 odin sshd[24810]: error: PAM: authentication error for
> root from server.fabian.cz
>
> Oct 22 12:57:07 odin sshd[24813]: error: PAM: authentication error for
> root from 62.213.201.100
>
> Oct 22 12:57:26 odin sshd[24816]: error: PAM: authentication error for
> root from 83.18.24.58
>
> Oct 22 12:58:03 odin sshd[24822]: error: PAM: authentication error for
> root from 99.13.226.154
>
> Oct 22 12:58:38 odin sshd[24825]: error: PAM: authentication error for
> root from crm.nepinc.com
>
> Oct 22 13:00:06 odin sshd[24846]: error: PAM: authentication error for
> root from 85.22.60.6
>
>
>
>
>
> _______________________________________________
> freebsd-questions@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to
> "freebsd-questions-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?544D62C65A99325660F7D6D3>