skrepka
30-08-2008, 18:32
у меня был роутрер настроен вай фай с веб ключом, с провайдером соединаюсь через pptp, со стороны вана открыт SSH, используется прошивка от Олега. Заметил что в дни кокгда мой комп был выклучен был сворован траффик. Есть три предположения первое ломанули роутер, второе ломанули вай фай , третий вариан чувак с моей локалки своровал логин и пароль на инет. Хотелось бы узнать реализовался ли первый или второй пункт. Храняться ли на роутере старые логи, и если есть что в них искать?
Вот те логи что я нашол на роутере. По данным провайдера сессия закончилась как раз в 3 14. В это время мой комп точно был выключен.Правильно я понимаю что похоже ломали через SSH?
Aug 25 15:45:46 pptp[131]: anon log[logecho:pptp_ctrl.c:670]: Echo Reply received.
Aug 25 15:46:46 pptp[131]: anon log[logecho:pptp_ctrl.c:670]: Echo Reply received.
Aug 25 15:46:46 pptp[131]: anon log[logecho:pptp_ctrl.c:672]: no more Echo Reply/Request packets will be reported.
Aug 25 17:37:15 ntp client: Synchronizing time with time.nist.gov ...
Aug 25 19:37:19 ntp client: Synchronizing time with time.nist.gov ...
Aug 25 21:22:00 dropbear[197]: Child connection from ::ffff:69.147.229.200:59690
Aug 25 21:22:00 dropbear[198]: Child connection from ::ffff:69.147.229.200:59868
Aug 25 21:22:05 dropbear[197]: exit before auth: Failed to get remote version
Aug 25 21:22:05 dropbear[198]: exit before auth: Failed to get remote version
Aug 25 21:37:24 ntp client: Synchronizing time with time.nist.gov ...
Aug 25 23:37:28 ntp client: Synchronizing time with time.nist.gov ...
Aug 26 03:14:21 pppd[114]: Terminating connection due to lack of activity.
Aug 26 03:14:22 pppd[114]: Connection terminated.
Aug 26 03:14:22 pppd[114]: Connect time 20328434.2 minutes.
Aug 26 03:14:22 pppd[114]: Sent 27333550 bytes, received 1221931407 bytes.
Aug 26 03:14:22 pptp[127]: anon warn[decaps_hdlc:pptp_gre.c:197]: short read (-1): Input/output error
Aug 26 03:14:22 pptp[127]: anon warn[decaps_hdlc:pptp_gre.c:209]: pppd may have shutdown, see pppd log
Aug 26 03:14:22 pptp[131]: anon log[callmgr_main:pptp_callmgr.c:230]: Closing connection
Aug 26 03:14:22 pptp[131]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 12 'Call-Clear-Request'
Aug 26 03:14:22 dnsmasq[77]: read /etc/hosts - 5 addresses
Aug 26 03:14:22 dnsmasq[77]: reading /tmp/resolv.conf
Aug 26 03:14:22 dnsmasq[77]: using nameserver 192.168.0.14#53
Aug 26 03:14:22 dnsmasq[77]: using nameserver 192.168.0.8#53
Aug 26 03:14:22 PPTP: Disconnected
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 12 'Call-Clear-Request'
Aug 26 03:14:24 pptp[131]: anon log[pptp_conn_close:pptp_ctrl.c:433]: Closing PPTP connection
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 3 'Stop-Control-Connection-Request'
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_disp:pptp_ctrl.c:922]: Call disconnect notification received (call id 59306)
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_disp:pptp_ctrl.c:781]: Received Stop Control Connection Request.
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 4 'Stop-Control-Connection-Reply'
Aug 26 03:14:26 pptp[131]: anon log[call_callback:pptp_callmgr.c:77]: Closing connection
Aug 26 03:37:37 ntp client: Synchronizing time with time.nist.gov ...
Вот те логи что я нашол на роутере. По данным провайдера сессия закончилась как раз в 3 14. В это время мой комп точно был выключен.Правильно я понимаю что похоже ломали через SSH?
Aug 25 15:45:46 pptp[131]: anon log[logecho:pptp_ctrl.c:670]: Echo Reply received.
Aug 25 15:46:46 pptp[131]: anon log[logecho:pptp_ctrl.c:670]: Echo Reply received.
Aug 25 15:46:46 pptp[131]: anon log[logecho:pptp_ctrl.c:672]: no more Echo Reply/Request packets will be reported.
Aug 25 17:37:15 ntp client: Synchronizing time with time.nist.gov ...
Aug 25 19:37:19 ntp client: Synchronizing time with time.nist.gov ...
Aug 25 21:22:00 dropbear[197]: Child connection from ::ffff:69.147.229.200:59690
Aug 25 21:22:00 dropbear[198]: Child connection from ::ffff:69.147.229.200:59868
Aug 25 21:22:05 dropbear[197]: exit before auth: Failed to get remote version
Aug 25 21:22:05 dropbear[198]: exit before auth: Failed to get remote version
Aug 25 21:37:24 ntp client: Synchronizing time with time.nist.gov ...
Aug 25 23:37:28 ntp client: Synchronizing time with time.nist.gov ...
Aug 26 03:14:21 pppd[114]: Terminating connection due to lack of activity.
Aug 26 03:14:22 pppd[114]: Connection terminated.
Aug 26 03:14:22 pppd[114]: Connect time 20328434.2 minutes.
Aug 26 03:14:22 pppd[114]: Sent 27333550 bytes, received 1221931407 bytes.
Aug 26 03:14:22 pptp[127]: anon warn[decaps_hdlc:pptp_gre.c:197]: short read (-1): Input/output error
Aug 26 03:14:22 pptp[127]: anon warn[decaps_hdlc:pptp_gre.c:209]: pppd may have shutdown, see pppd log
Aug 26 03:14:22 pptp[131]: anon log[callmgr_main:pptp_callmgr.c:230]: Closing connection
Aug 26 03:14:22 pptp[131]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 12 'Call-Clear-Request'
Aug 26 03:14:22 dnsmasq[77]: read /etc/hosts - 5 addresses
Aug 26 03:14:22 dnsmasq[77]: reading /tmp/resolv.conf
Aug 26 03:14:22 dnsmasq[77]: using nameserver 192.168.0.14#53
Aug 26 03:14:22 dnsmasq[77]: using nameserver 192.168.0.8#53
Aug 26 03:14:22 PPTP: Disconnected
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 12 'Call-Clear-Request'
Aug 26 03:14:24 pptp[131]: anon log[pptp_conn_close:pptp_ctrl.c:433]: Closing PPTP connection
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 3 'Stop-Control-Connection-Request'
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_disp:pptp_ctrl.c:922]: Call disconnect notification received (call id 59306)
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_disp:pptp_ctrl.c:781]: Received Stop Control Connection Request.
Aug 26 03:14:24 pptp[131]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 4 'Stop-Control-Connection-Reply'
Aug 26 03:14:26 pptp[131]: anon log[call_callback:pptp_callmgr.c:77]: Closing connection
Aug 26 03:37:37 ntp client: Synchronizing time with time.nist.gov ...