Posiible attach need help!

Discussion in 'Installation/Configuration' started by sulfuric, May 16, 2006.

  1. sulfuric

    sulfuric ISPConfig Developer ISPConfig Developer

    I discover this on my auth.log, Is it an attack?, what can i do?? thanks:

    May 16 11:23:21 omaxserver sshd[29974]: Failed password for invalid user http from 64.184.4.15 port 39138 ssh2
    May 16 11:23:24 omaxserver sshd[29976]: Invalid user httpd from 64.184.4.15
    May 16 11:23:24 omaxserver sshd[29976]: Address 64.184.4.15 maps to mx1.citznet.com, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!
    May 16 11:23:24 omaxserver sshd[29976]: (pam_unix) check pass; user unknown
    May 16 11:23:24 omaxserver sshd[29976]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.184.4.15
    May 16 11:23:25 omaxserver sshd[29976]: Failed password for invalid user httpd from 64.184.4.15 port 42929 ssh2
    May 16 11:23:28 omaxserver sshd[29980]: Invalid user pop from 64.184.4.15
    May 16 11:23:28 omaxserver sshd[29980]: Address 64.184.4.15 maps to mx1.citznet.com, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!

    .....And a lot of attempts..... :confused:
     
  2. falko

    falko Super Moderator ISPConfig Developer

  3. sjau

    sjau Local Meanie Moderator

    Thx for that HowTo.... already a couple of IP addresses are now in my hosts.deny file :)
     

Share This Page