Re: What to do with attackers?
On Fri, 4 Nov 2005, Thomas wrote:
> recently, i can see ofthen brute force attacks in my ssh logfile.
> A friend of mine, who has the same ISP gets the same bruteforce attacks.
>
> What would be an adequate reaction to repeated ssh bruteforce attacks?
you should "know" if and that your systems are 99% secure as is
- proving it to yourself or against the attackers is a
separate problem
you should have all your "important" data backed up elsewhere
where you can guarantee with 100% accuracy you can restore any
file to any date and time
> Should i contact the owner of the attackers ip address?
if you like ..
> Should i do something else?
if you like .. tons of other things ... like "do your own real work"
and not worry too much about the free audits unless you're not sure
about the security of ALL your systems and data :-)
--------
in my world... the attackers is 100% successful if they take more
than a minute or two of my time including checking log files
and who they are etc..etc.. unless that is the actual tasks
i'm supposed to be doing at the time and being paid for tracking
them down
c ya
alvin
Reply to: