Hack attempts

[ne...]

On Jul 24, 2004 at 06:48, Thomas Sapp in a soothing rage wrote:

>On Sat, 2004-07-24 at 06:28, Edwin Dicker wrote:
>> The last two days i got bugged by someone from korea and someone from japan.
>> his is what i find in my LogWatch :
>> --------------------- SSHD Begin ------------------------ 
>> 
>> 
>> Failed logins from these:
>>    guest/password from ::ffff:211.119.136.170: 1 Time(s)
>>    test/password from ::ffff:211.119.136.170: 1 Time(s)
>> 
>> Illegal users from these:
>>    guest/none from ::ffff:211.119.136.170: 1 Time(s)
>>    guest/password from ::ffff:211.119.136.170: 1 Time(s)
>>    test/none from ::ffff:211.119.136.170: 1 Time(s)
>>    test/password from ::ffff:211.119.136.170: 1 Time(s)
>> 
>> is this a known hack attempt by some sort of program ? because for both
>> tries the same usernames have been tried to use : guest and test
>> 
>> cheers
>> Edwin
>I have seen a lot of this lately too.  I've just started blocking each
>individual IP address as it comes up so they can't try again.
I've noticed these too. I do a
$IPT -A INPUT -s 192.168.52.0/24 -p tcp --syn --destination-port 22 -j ACCEPT
instead. This will only ssh packets for machines that are on my local
network. I have a duplicate rule for work machines that I connect 
from. All other traffic gets dropped. Telnet is not running on any of 
my machines.

N.Emile...
-- 
Registered Linux User # 125653 (http://counter.li.org)
Switch to: http://www.speakeasy.net/refer/190653
Love means nothing to a tennis player.
 11:52:01  up 26 days,  5:07,  4 users,  load average: 0.00, 0.00, 0.00