Re: what to do?

From: AragonX (aragonx_at_dcsnow.com)
Date: 08/30/05

  • Next message: Michael Puchol: "Re: FW: Your opinion on Skype" 
    Date: Tue, 30 Aug 2005 07:52:16 -0400 (EDT)
To: security-basics@securityfocus.com

    <quote who="Jayson Anderson">
    > On Thu, 2005-08-25 at 00:30 -0700, Bill Smith wrote:
    >> Hi Guys,
    >>
    >> I noticed that someone is trying to hacker into my
    >> machine. Please see below is the content of
    >> /var/log/security.
    >> what I would like some advice of you guys is, what
    >> will I do with these people?
    >> btw, I do have FW

    Do you need to be able to access your machine remotely through ssh?

       If no then disable.

    Do others need to be able to access your machine remotely through ssh?

       If no then 'AllowUsers = <enter your user name>' in sshd_config

    Do you have a limited number of domains you logon from?

       If yes then '$IPTABLES -A INPUT -p tcp -i $EXTIF -s yourdomain.com
    --dport 22 -j ACCEPT' in your firewall rules. Need a default deny
    policy.

    Finally I also suggest:

       ListenAddress <anything other than 22>
       PermitRootLogin no

    This of course assumes that you are using a newer version of Linux.

  • Next message: Michael Puchol: "Re: FW: Your opinion on Skype"

    Relevant Pages

    • Re: Need for new openSUSE users
      ... It is just very common to quote corretly and not have the ... the rule is to quote correctly. ... one may wish to try specifying (e.g., for ssh) that rate limiting is to ... Lines 414-422 are, at least on my openSUSE v11 system, as follows: ...
      (alt.os.linux.suse)
    • Re: any way to confirm break-in?
      ... My Ubuntu machine, hooked up with the Internet with sshd etc running ... made through ssh to access the machine from a couple of IP addresses. ... If a hacker did log in successfully you might assume he has covered ...
      (comp.os.linux.security)
    • Re: script for auto ftp
      ... >> Just quote them ... there or setup up a .netrc file for ftp. ... Additionally, if the remote host has SSH, you can use the 'scp' command and ssh ...
      (linux.redhat)
    • Re: what to do?
      ... On Thu, 2005-08-25 at 00:30 -0700, Bill Smith wrote: ... > I noticed that someone is trying to hacker into my ... If you aren't getting them then your SSH server isn't working:-P. ... but the log clutter can be a nuisance. ...
      (Security-Basics)
    • Re: OpenSSH Updaten
      ... Auf dem Server laufen nur bestimmte Dienste (SSH, HTTP, MAIL, CounterStrike Source und TeamSpeak) und er ist nur ein GamingServer. ... Ich gehe davon mal aus das der Hacker über den SSH Dienst reingekommen ist, da auf jeden Fall ein root-Kit installiert wurde. ...
      (de.comp.os.unix.linux.misc)