Re: SSH attack

To: debian-user@lists.debian.org
Subject: Re: SSH attack
From: Pollywog <linux-debian@shadypond.com>
Date: Mon, 3 Oct 2005 18:23:15 +0000
Message-id: <[🔎] 200510031823.15374.linux-debian@shadypond.com>
In-reply-to: <[🔎] 4341751B.1060009@ix.netcom.com>
References: <[🔎] 547e6a320510022257h16636051l1c2ce306d0cb0963@mail.gmail.com> <[🔎] 4341751B.1060009@ix.netcom.com>

On 10/03/2005 06:14 pm, Marty wrote:
> Jared Hall wrote:
> > It looks like I am being rooted right now.  How do I toss this guy off
> > of my system.  he has an IP address of 210.95.212.131
>
> It's a kid!  Whois returns "Hanguk Kwangsan Technoledge High School."

I get lots of those, often from Asia and S. America.  Block the IP at the 
firewall.  If you install Portsentry, you can have Portsentry block them 
automatically using iptables.  IIRC you can have a list of IP addresses that 
are exempt from blocking.

8)

Reply to:

Follow-Ups:
- Re: SSH attack
  - From: "David E. Fox" <dfox@m206-157.dsl.tsoft.com>

References:
- SSH attack
  - From: Jared Hall <jrhall@gmail.com>
- Re: SSH attack
  - From: Marty <martyb@ix.netcom.com>

Prev by Date: Re: apache2 mod_perl sarge not working
Next by Date: Re: changing default document root directory in apache 2
Previous by thread: Re: SSH attack
Next by thread: Re: SSH attack
Index(es):
- Date
- Thread