Re: [gentoo-user] OT - ipkungfu perhaps not doing its job

[Alan McKinnon]

On Thursday 16 November 2006 20:29, Michael Sullivan wrote:
> Can anyone tell me why I have about a hundred of these
>
> Nov 16 08:00:03 bullet ftp(pam_unix)[2045]: authentication failure;
> logname= uid=0 euid=0 tty= ruser= rhost=222.135.146.45
> Nov 16 08:00:06 bullet ftp(pam_unix)[2045]: authentication failure;
> logname= uid=0 euid=0 tty= ruser= rhost=222.135.146.45
> Nov 16 08:00:09 bullet ftp(pam_unix)[2045]: authentication failure;
> logname= uid=0 euid=0 tty= ruser= rhost=222.135.146.45
> Nov 16 08:00:12 bullet ftp(pam_unix)[2045]: authentication failure;
> logname= uid=0 euid=0 tty= ruser= rhost=222.135.146.45
>
> when that IP address is in /etc/ipkungfu/deny_hosts.conf?  Here's my
> rules; I don't understand them:

[snip]

>     1    55 DROP       all  --  eth0   any     222.135.146.45
> anywhere

Some scipt kiddie is trying a brute force attack on your ftp port trying 
random combinations of user name and pasword every three seconds.

'dig 45.146.135.222.in-addr.arpa PTR' tells me that the address belongs 
to some maschine on network sdjnptt.net.cn and that turns out to be 
what looks like some chinese isp.

So, a chinese person is trying to exploit your machine. Hey, it happens. 
And will happen for about the rest of your life. The solution is to 
drop them at the firewall, and the above rule is doing exactly that.

This specific attack from this specific person at that specific address 
si no longer something you need to worry about :-)


alan

-- 
gentoo-user@g.o mailing list