| 1 |
Greg Watson wrote: |
| 2 |
> Over the past few days I've noticed many attempts from different sources |
| 3 |
> trying to login on ssh via guest/test/admin/etc accounts. Looking |
| 4 |
> further into the matter I found SANS is looking for information too. |
| 5 |
> |
| 6 |
> http://www.incidents.org/diary.php?date=2004-07-23 |
| 7 |
> http://www.incidents.org/diary.php?date=2004-07-25 |
| 8 |
> |
| 9 |
> and more information here: |
| 10 |
> http://www.dslreports.com/forum/remark,10854834~mode=flat~days=9999 |
| 11 |
> |
| 12 |
> It appears as the net is getting hit with these all over. I would guess |
| 13 |
> this is a very early stage of some kind of new worm/exploit in the |
| 14 |
> works. What is more, it appears to have the ability to pass some NAT |
| 15 |
> boxes by tricking them into replying back to the source. |
| 16 |
> |
| 17 |
> If you're not already doing so, I recommend to disable password |
| 18 |
> interactive login and enforce key only logins. This will prevent some |
| 19 |
> of the ssh exploits, brute-force attacks, and general script kiddies. |
| 20 |
> |
| 21 |
> And as always, upgrade to the latest version of OpenSSH/OpenSSL. |
| 22 |
|
| 23 |
I'm glad to know it isn't just me. I've been getting woken up at 4 or 5 in the |
| 24 |
morning by my phone beeping because of this crap. I have my server setup to |
| 25 |
email me and send me a text message to my cell phone when there is a failed |
| 26 |
login attempt. |
| 27 |
|
| 28 |
-- |
| 29 |
Andrew Gaffney |
| 30 |
Network Administrator |
| 31 |
Skyline Aeronautics, LLC. |
| 32 |
636-357-1548 |
| 33 |
|
| 34 |
|
| 35 |
-- |
| 36 |
gentoo-security@g.o mailing list |
Archives