On Sun, Jun 10, 2007 at 12:10:29PM -0700, Mike Bird wrote: > On Sunday 10 June 2007 09:29, David Baron wrote: > > SSH is not exposed from local to internet! > > It is to a "VMZ" which is a virtual machine that may have been running at > > the time. But who is this IP (virtual machines are like 10.0.2.15 or such) > > ?? > > If the attacker addesss is 10.0.2.15 then it is either an attacker on your > LAN or it is an attacker receiving assistance (SNAT) from your firewall. > > If the attacked address is 10.0.2.15 then SSH is probably being port- > -forwarded (DNAT) by your firewall. > Unless he happens to have an ISP which gives out RFC1918 addresses (e.g., as happens often in college dorms). Regards, -Roberto -- Roberto C. Sánchez http://people.connexer.com/~roberto http://www.connexer.com
Attachment:
signature.asc
Description: Digital signature