Linux server discussion

Atown said:
yeah i have to go there myself and install it
Click to expand...

if you really want some fun run a packet sniffer and figure out what routing protocol they are using. Then poisen the routing tables such that packets go in a massive loop. If you do it right they will go nuts, confiscate your server and fine you. (HINT: that isn't a very bright idea)
 
Lets see the list of losers who have hit my ban list so far:

Code: 
cat /var/log/denyhosts | grep new
2007-12-01 07:52:30,139 - denyhosts   : INFO     new denied hosts: ['125.64.11.15']
2007-12-02 21:12:14,027 - denyhosts   : INFO     new denied hosts: ['58.61.147.51']
2007-12-03 00:16:15,005 - denyhosts   : INFO     new denied hosts: ['89.149.214.219']
2007-12-03 02:16:14,703 - denyhosts   : INFO     new denied hosts: ['202.111.154.228']
2007-12-04 04:21:35,906 - denyhosts   : INFO     new denied hosts: ['74.94.201.22']
2007-12-04 07:00:06,354 - denyhosts   : INFO     new denied hosts: ['69.60.121.63']

Code: 
cat /var/log/secure | grep -i -e refused -e possible
Dec  2 21:12:15 zyria sshd[2142]: refused connect from ::ffff:58.61.147.51 (::ffff:58.61.147.51)
Dec  2 21:12:16 zyria sshd[2143]: refused connect from ::ffff:58.61.147.51 (::ffff:58.61.147.51)
Dec  2 21:12:25 zyria sshd[2144]: refused connect from ::ffff:58.61.147.51 (::ffff:58.61.147.51)
Dec  3 00:16:01 zyria sshd[2955]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:01 zyria sshd[2956]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:01 zyria sshd[2959]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:04 zyria sshd[2962]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:04 zyria sshd[2961]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:05 zyria sshd[2963]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:08 zyria sshd[2968]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:08 zyria sshd[2967]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:08 zyria sshd[2971]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:12 zyria sshd[2973]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:12 zyria sshd[2974]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:12 zyria sshd[2975]: reverse mapping checking getaddrinfo for unknown.vectoral.info [89.149.214.219] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  3 00:16:15 zyria sshd[2979]: refused connect from ::ffff:89.149.214.219 (::ffff:89.149.214.219)
Dec  3 00:16:15 zyria sshd[2980]: refused connect from ::ffff:89.149.214.219 (::ffff:89.149.214.219)
Dec  3 00:16:15 zyria sshd[2981]: refused connect from ::ffff:89.149.214.219 (::ffff:89.149.214.219)
Dec  3 02:16:14 zyria sshd[3451]: refused connect from ::ffff:202.111.154.228 (::ffff:202.111.154.228)
Dec  3 02:16:15 zyria sshd[3452]: refused connect from ::ffff:202.111.154.228 (::ffff:202.111.154.228)
Dec  3 02:16:15 zyria sshd[3453]: refused connect from ::ffff:202.111.154.228 (::ffff:202.111.154.228)
Dec  4 04:21:26 zyria sshd[6733]: reverse mapping checking getaddrinfo for 74-94-201-22-pennsylvania.hfc.comcastbusiness.net [74.94.201.22] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  4 04:21:30 zyria sshd[6735]: reverse mapping checking getaddrinfo for 74-94-201-22-pennsylvania.hfc.comcastbusiness.net [74.94.201.22] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  4 04:21:33 zyria sshd[6737]: reverse mapping checking getaddrinfo for 74-94-201-22-pennsylvania.hfc.comcastbusiness.net [74.94.201.22] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  4 04:21:35 zyria sshd[6740]: reverse mapping checking getaddrinfo for 74-94-201-22-pennsylvania.hfc.comcastbusiness.net [74.94.201.22] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  4 04:21:36 zyria sshd[6742]: reverse mapping checking getaddrinfo for 74-94-201-22-pennsylvania.hfc.comcastbusiness.net [74.94.201.22] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  4 04:21:37 zyria sshd[6744]: refused connect from ::ffff:74.94.201.22 (::ffff:74.94.201.22)
Dec  4 04:21:37 zyria sshd[6745]: refused connect from ::ffff:74.94.201.22 (::ffff:74.94.201.22)
Dec  4 04:21:43 zyria sshd[6746]: refused connect from ::ffff:74.94.201.22 (::ffff:74.94.201.22)
Dec  4 04:21:43 zyria sshd[6747]: refused connect from ::ffff:74.94.201.22 (::ffff:74.94.201.22)
Dec  4 07:00:04 zyria sshd[12267]: reverse mapping checking getaddrinfo for 63-121-60-69.serverpronto.com [69.60.121.63] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  4 07:00:04 zyria sshd[12269]: reverse mapping checking getaddrinfo for 63-121-60-69.serverpronto.com [69.60.121.63] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  4 07:00:04 zyria sshd[12271]: reverse mapping checking getaddrinfo for 63-121-60-69.serverpronto.com [69.60.121.63] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  4 07:00:04 zyria sshd[12273]: reverse mapping checking getaddrinfo for 63-121-60-69.serverpronto.com [69.60.121.63] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  4 07:00:06 zyria sshd[12275]: refused connect from ::ffff:69.60.121.63 (::ffff:69.60.121.63)
Dec  4 07:00:06 zyria sshd[12276]: refused connect from ::ffff:69.60.121.63 (::ffff:69.60.121.63)
Dec  4 07:00:06 zyria sshd[12277]: refused connect from ::ffff:69.60.121.63 (::ffff:69.60.121.63)
Dec  4 07:00:06 zyria sshd[12278]: refused connect from ::ffff:69.60.121.63 (::ffff:69.60.121.63)

Code: 
cat /var/log/secure | grep Failed
Dec  2 21:11:58 zyria sshd[2127]: Failed password for root from 58.61.147.51 port 10544 ssh2
Dec  2 21:12:02 zyria sshd[2129]: Failed password for invalid user fluffy from 58.61.147.51 port 10679 ssh2
Dec  2 21:12:05 zyria sshd[2131]: Failed password for invalid user admin from 58.61.147.51 port 10830 ssh2
Dec  2 21:12:10 zyria sshd[2133]: Failed password for invalid user test from 58.61.147.51 port 10966 ssh2
Dec  2 21:12:12 zyria sshd[2135]: Failed password for root from 58.61.147.51 port 11057 ssh2
Dec  2 21:12:15 zyria sshd[2137]: Failed password for invalid user guest from 58.61.147.51 port 11115 ssh2
Dec  2 21:12:16 zyria sshd[2140]: Failed password for invalid user fluffy from 58.61.147.51 port 11195 ssh2
Dec  3 00:16:03 zyria sshd[2955]: Failed password for invalid user test from 89.149.214.219 port 57854 ssh2
Dec  3 00:16:03 zyria sshd[2956]: Failed password for invalid user test from 89.149.214.219 port 36369 ssh2
Dec  3 00:16:03 zyria sshd[2959]: Failed password for invalid user test from 89.149.214.219 port 38990 ssh2
Dec  3 00:16:06 zyria sshd[2962]: Failed password for invalid user guest from 89.149.214.219 port 36685 ssh2
Dec  3 00:16:06 zyria sshd[2961]: Failed password for invalid user guest from 89.149.214.219 port 58175 ssh2
Dec  3 00:16:07 zyria sshd[2963]: Failed password for invalid user guest from 89.149.214.219 port 39310 ssh2
Dec  3 00:16:11 zyria sshd[2968]: Failed password for invalid user admin from 89.149.214.219 port 58479 ssh2
Dec  3 00:16:11 zyria sshd[2967]: Failed password for invalid user admin from 89.149.214.219 port 36987 ssh2
Dec  3 00:16:11 zyria sshd[2971]: Failed password for invalid user admin from 89.149.214.219 port 39613 ssh2
Dec  3 00:16:14 zyria sshd[2973]: Failed password for invalid user admin from 89.149.214.219 port 37341 ssh2
Dec  3 00:16:14 zyria sshd[2974]: Failed password for invalid user admin from 89.149.214.219 port 58833 ssh2
Dec  3 00:16:14 zyria sshd[2975]: Failed password for invalid user admin from 89.149.214.219 port 39945 ssh2
Dec  3 02:15:59 zyria sshd[3423]: Failed password for invalid user staff from 202.111.154.228 port 44434 ssh2
Dec  3 02:16:03 zyria sshd[3425]: Failed password for invalid user staff from 202.111.154.228 port 45220 ssh2
Dec  3 02:16:03 zyria sshd[3427]: Failed password for invalid user staff from 202.111.154.228 port 45294 ssh2
Dec  3 02:16:03 zyria sshd[3430]: Failed password for invalid user sales from 202.111.154.228 port 45406 ssh2
Dec  3 02:16:06 zyria sshd[3433]: Failed password for invalid user sales from 202.111.154.228 port 46396 ssh2
Dec  3 02:16:06 zyria sshd[3432]: Failed password for invalid user sales from 202.111.154.228 port 46398 ssh2
Dec  3 02:16:07 zyria sshd[3436]: Failed password for invalid user recruit from 202.111.154.228 port 46444 ssh2
Dec  3 02:16:10 zyria sshd[3442]: Failed password for invalid user alias from 202.111.154.228 port 47834 ssh2
Dec  3 02:16:10 zyria sshd[3438]: Failed password for invalid user recruit from 202.111.154.228 port 47760 ssh2
Dec  3 02:16:10 zyria sshd[3439]: Failed password for invalid user recruit from 202.111.154.228 port 47762 ssh2
Dec  3 02:16:14 zyria sshd[3445]: Failed password for invalid user office from 202.111.154.228 port 48948 ssh2
Dec  3 02:16:14 zyria sshd[3446]: Failed password for invalid user alias from 202.111.154.228 port 49000 ssh2
Dec  3 02:16:14 zyria sshd[3447]: Failed password for invalid user alias from 202.111.154.228 port 49002 ssh2
Dec  4 04:21:29 zyria sshd[6733]: Failed password for root from 74.94.201.22 port 33351 ssh2
Dec  4 04:21:32 zyria sshd[6735]: Failed password for root from 74.94.201.22 port 33525 ssh2
Dec  4 04:21:35 zyria sshd[6737]: Failed password for root from 74.94.201.22 port 33670 ssh2
Dec  4 04:21:37 zyria sshd[6742]: Failed password for root from 74.94.201.22 port 33817 ssh2
Dec  4 04:21:37 zyria sshd[6740]: Failed password for root from 74.94.201.22 port 33804 ssh2
Dec  4 07:00:06 zyria sshd[12269]: Failed password for root from 69.60.121.63 port 55568 ssh2
Dec  4 07:00:06 zyria sshd[12267]: Failed password for root from 69.60.121.63 port 34888 ssh2
Dec  4 07:00:06 zyria sshd[12271]: Failed password for root from 69.60.121.63 port 36154 ssh2
Dec  4 07:00:06 zyria sshd[12273]: Failed password for root from 69.60.121.63 port 56277 ssh2
Ahh, the fun of life in the open.
 
Last edited:
Atown said:
wow thats amazing
Click to expand...

I recon that any server gets hit with a dictionary attacker once every 12 hours at the least. Already there was another IP banned this morning, lol. It doesn't matter if you have anything pointing to it because they are scanning ip ranges.
 
what program are u running to ban them out of curiosity.
 
Code: 
Name   : denyhosts
Arch   : noarch
Version: 2.6
Release: 7.fc8
Size   : 95 k
Repo   : fedora
Summary: A script to help thwart ssh server attacks
Description:
DenyHosts is a Python script that analyzes the sshd server log
messages to determine which hosts are attempting to hack into your
system. It also determines what user accounts are being targeted. It
keeps track of the frequency of attempts from each host and, upon
discovering a repeated attack host, updates the /etc/hosts.deny file
to prevent future break-in attempts from that host.  Email reports can
be sent to a system admin.
 
yeah but am i still able to get into my ssh without getting myself banned?
 
Atown said:
yeah but am i still able to get into my ssh without getting myself banned?
Click to expand...

I can, you have to fail the 3 passwords it seems to have it marked as a failure. You can just control-c to end the session and it doesn't count either. I can use a recovery console on my VPS so if it ever locks me I will just remove myself from the list.
 
Atown said:
yeah but am i still able to get into my ssh without getting myself banned?
Click to expand...

The best security in the world is useless without being able to use it. It is rather funny when people have to struggle with their own security measures (*cough* vista).
 
now how do i figure out how much amps my server will take. im finding stuff on like new xeons dual core, 64 bit whatevers, and i need to figure out how much mine is because the community colo wont let me take it there if its over 1.5amps
 
1.5 amps? My dual p-3 server draws more than that. is it 1.5 amp or 10.5 amps? double check. If it's 1.5 your options are severely limited.

basically they are limiting you to 200 watts of power on the psu. Given the inefficiencies in power supplies that's closer to 175 watt power supply rating. you are looking at 1 cpu. p-3 based around 1ghz or slower less than 1 gig of ram and one or two ide drives spinning at 5400 rpm.
 
Hescominsoon said:
1.5 amps? My dual p-3 server draws more than that. is it 1.5 amp or 10.5 amps? double check. If it's 1.5 your options are severely limited.

basically they are limiting you to 200 watts of power on the psu. Given the inefficiencies in power supplies that's closer to 175 watt power supply rating. you are looking at 1 cpu. p-3 based around 1ghz or slower less than 1 gig of ram and one or two ide drives spinning at 5400 rpm.
Click to expand...

You could probably put in a Via C7 class system in a 1u case and be well within 1.5 amps. Buy a "green" machine at wall mart, rip out the motherboard, cpu, ram and hard drive and throw it in a decent 1U case with a lower wattage power supply (with pfc).
 
Requirements

* No for-profit activity of any kind. Commercial activity conducted by a non-profit organization is OK.
* You must agree to our terms of service.
* Total power consumption for the box must be under 1.5 Amps, unless prior arrangements are made.
* You are responsible for mounting your box in the cabinet. We have shelving space for small, low power, mini-itx boxes.
 
figuring in having to add 25% to the rated draw of the power supply due to inefficiencies that means you are looking at
[SIZE=+1]250 plus 62.5 = 312.5[/SIZE]

that equals
[SIZE=+1]312.5 divided by 120 = 2.60416667[/SIZE]


your a hair over a full amp over your power budget. Now this is max power but when you are planning for power always plan for the max. I would talk to the colo and see if they will allow your 2.6 amp(max) machine in there.
 
Hescominsoon said:
figuring in having to add 25% to the rated draw of the power supply due to inefficiencies that means you are looking at
[SIZE=+1]250 plus 62.5 = 312.5[/SIZE]

that equals
[SIZE=+1]312.5 divided by 120 = 2.60416667[/SIZE]


your a hair over a full amp over your power budget. Now this is max power but when you are planning for power always plan for the max. I would talk to the colo and see if they will allow your 2.6 amp(max) machine in there.
Click to expand...

Best bet is to give the power supplies max rating and the hardware instead of giving them a calculated amperage. Chances are they know the draw can say aye or nay.
 
vibrokatana said:
Best bet is to give the power supplies max rating and the hardware instead of giving them a calculated amperage. Chances are they know the draw can say aye or nay.
Click to expand...

just giving him the calculations since most psu average 75% efficiency so you have to add 25% more to make sue you know what it's pulling at the wall..:) either way works..:)
 
Hescominsoon said:
just giving him the calculations since most psu average 75% efficiency so you have to add 25% more to make sue you know what it's pulling at the wall..:) either way works..:)
Click to expand...

1 / (3/4) = 4/3 = 1.333...

75% efficiency draws 33% more juice to achieve the stated rating.
 
You must log in or register to reply here.
Back
Top