"possible break-in attempt!"

supanatral · 05-14-2010, 07:43 AM

Everyday logwatch emails me with the latest statistics on the server and all the logs. Today I looked at the logs and here's what I found:

Quote:

**Unmatched Entries**
reverse mapping checking getaddrinfo for 221-143-48-7.tongkni.co.kr failed - POSSIBLE BREAK-IN ATTEMPT! : 2 time(s) Excess permission or bad ownership on file /var/log/btmp : 33 time(s) reverse mapping checking getaddrinfo for 34.174.164.60.broad.jq.gs.dynamic.163data.com.cn failed - POSSIBLE BREAK-IN ATTEMPT! : 23 time(s)

This sounds like something to worry about....

AlucardZero · 05-14-2010, 08:33 AM

"reverse mapping checking getaddrinfo for xxxxx failed" is a red herring; it just means that the forward and reverse DNS don't match which means the ISP sucks and nothing else.

You should fix /var/log/btmp, but that's also not important.

Now, the count of 23 SSH login attempts from one host is. Look around at topics here and Google on SSH security. Start by installing DenyHosts or Fail2Ban, to prevent people from getting more than (e.g.) 5 login attempts before being blocked.