Someone from ev1servers is trying to hack my server

[Joe Gronlund]

--------------------- pam_unix Begin ------------------------
sshd:
Invalid Users:
Unknown Account: 980 Time(s)
Authentication Failures:
ftp (ev1s-67-15-203-25.ev1servers.net ): 35 Time(s)
games (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
smmsp (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
rpm (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
sshd (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
ident (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
gopher (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
nfsnobody (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
shutdown (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
bin (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
nobody (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
operator (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
unknown (ev1s-67-15-203-25.ev1servers.net ): 980 Time(s)
mail (ev1s-67-15-203-25.ev1servers.net ): 40 Time(s)
rpcuser (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
daemon (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
uucp (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
adm (ev1s-67-15-203-25.ev1servers.net ): 45 Time(s)
halt (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
sync (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
mysql (ev1s-67-15-203-25.ev1servers.net ): 35 Time(s)
news (ev1s-67-15-203-25.ev1servers.net ): 5 Time(s)
root (ev1s-67-15-203-25.ev1servers.net ): 395 Time(s)


There is about 500 more, but i wont post them

[WurkAnimal]

Whos your host right now?

[Joe Gronlund]

Servermatrix/The Planet, this is the firewall logs. They never got past that.

[Zachery]

Welcome to the wonders of running a public server, someone tried to login to one of my machines with root password 5000 times... they've never been back. Its just looking for weak usernames/passwords to get into the system.

[Joe Gronlund]

Welcome to the wonders of running a public server, someone tried to login to one of my machines with root password 5000 times... they've never been back. Its just looking for weak usernames/passwords to get into the system.

I am use to attempts to login, was just surprised to see ev1servers to actually try. Its obviously someone from ev1 using a shell to try and login, but still surprised me nonetheless..

[KingSpade]

It's funny to see the random usernames that some will try and use. Larger attempts are usually automated so they simply generate a rather long listing of possible usernames...however, I find quite a few of them to be quite funny .

[Steve Machol]

I get on average about 3 server hacking attempts a day. I constantly monitor /var/log/secure for activity. And when I find someone attempting to break in, I block that IP with iptables.

[ManagerJosh]

You should turn over the details to the EV1 Abuse team to have them look into the matter.

[RichM]

I get on average about 3 server hacking attempts a day. I constantly monitor /var/log/secure for activity. And when I find someone attempting to break in, I block that IP with iptables.

BFD (Brute Force Detection) will automatically help detect and block Brute force attacks on your server and will then email you a report.

More info: http://www.rfxnetworks.com/bfd.php

[Steve Machol]

Thanks. I've seen that before but it also requires that APF be installed and I'm leary of installing apps on my server. Do you have any direct experience installing these?

[treasureman]

I have ran APF firewall and BFD for about 2 years. Great for keeping the hackers away!

[RichM]

Thanks. I've seen that before but it also requires that APF be installed and I'm leary of installing apps on my server. Do you have any direct experience installing these?

There is a guide here:

http://www.webhostgear.com/61.html

It is possible to lock yourself out. However, should this happen, all you'd need to do is ask your data centre to login via console and disable it so you can re-configure it.

[WurkAnimal]

How can you tell if anyones trying to hack into your server?

[Zachery]

Thanks. I've seen that before but it also requires that APF be installed and I'm leary of installing apps on my server. Do you have any direct experience installing these?

Steve APF is fairly foolproof to get installed and working. As long as you leave dev-mode on it will kill itself off after 5 min. (you leave it on while testing)

[treasureman]

I take back my previous post. I did have one problem with APF and that's on the latest version. I had to set antidos to off. APF kept blocking people from seeing my forum after they viewed a few pages. This is not a big deal, most people recommend having antidos set to off anyway.