Possible breakin attempt

jonfa · 07-19-2005, 08:33 PM

Hi all,

After checking my log files I came across the following in my /var/log/secure file on my FC3 Box:

Jul 17 17:26:04 computer1 sshd[12390]: Address 66.230.209.161 maps to closetcase.candidhosting.com, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!

I had SSH enabled on my router, but quickly closed the port. How can I ban this address? Should I be worried?

juanbobo · 07-19-2005, 08:51 PM

I don't think you should be too worried, someone apparently forged their address when trying to connect to your SSH server. It doesn't look like they are repeatedly trying to connet and regardless, the pause between login attempts with SSH makes it really difficult to brute force your password.

I think you can add the real IP to your /etc/hosts.deny file...

http://linux.about.com/od/commands/l...l5_hostsde.htm

Capt_Caveman · 07-19-2005, 09:35 PM

That warning can also be generated by NATed hosts behind a firewall due to the IP not resolving to the same hostname. Either way, If that host has no reason to be accessing your SSHd server it's still a good idea to ban it anyway.

juanbobo · 07-19-2005, 10:58 PM

Check out fwlogwatch: http://fwlogwatch.inside-security.de

It is cabable of realtime log analysis, so it may help you to block unwelcome peeps.

[bc]paddy.hm · 07-20-2005, 09:05 AM

Quote:

Originally posted by jonfa
Hi all,

After checking my log files I came across the following in my /var/log/secure file on my FC3 Box:

Jul 17 17:26:04 computer1 sshd[12390]: Address 66.230.209.161 maps to closetcase.candidhosting.com, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!

I had SSH enabled on my router, but quickly closed the port. How can I ban this address? Should I be worried?

Maybe DNS not setup correctly?