Re: [Hampshire] confused ssh newbie

Top Page

Reply to this message
Author: Peter Andrijeczko
Date:  
To: Hampshire LUG Discussion List
Subject: Re: [Hampshire] confused ssh newbie
Yep, that's the one.

I last used it about 3 years ago and I found it to be a bit flaky but I
think it's got a lot better since then.

Incidentally, there's nothing like being hacked to make you a bit paranoid
about security! :-)

About 8 years ago, I stupidly left an FTP server open to the Internet on my
home server, a hacker managed to buffer overflow to get to a root prompt,
then dumped an eggdrop script on it to launch denial-of-service attacks
against an IRC channel on the IRC server of an ISP in Scandinavia somewhere.
The first thing I knew about it was my ISP (NTL at the time) cut my internet
connection because of complaints from the Scandinavian ISP and I worked out
I'd been hacked. It took a week of phone calls and emailing log files to NTL
to prove it wasn't me and that I'd cleaned up my system!

--Peter

On 22 June 2011 09:21, Graeme Hilton <graeme.hilton@???> wrote:

> On 22 June 2011 09:12, Peter Andrijeczko <peter.andrijeczko@???>
> wrote:
> > There's other things you can do that help - I can't remember the
> application
> > names because I don't use them but there are daemon applications that
> > monitor for brute force attempts and if, say, more than 10 come from a
> > particular IP address within the space of a minute, it can block that IP
> > address temporarily or permanently by using TCP Wrappers or an iptables
> > firewall rule.
>
> There's a "fail2ban" script or package available somewhere that does
> what you describe.
>
> Graeme
>
> --
> Please post to: Hampshire@???
> Web Interface: https://mailman.lug.org.uk/mailman/listinfo/hampshire
> LUG URL: http://www.hantslug.org.uk
> --------------------------------------------------------------
>