Log in

Bekijk de volledige versie : Continuous "login attempt for nonexistent user" in syslog!?


ikerstges
11-02-2006, 19:24
Hiall,

My syslog is filling up with:


Feb 11 15:23:14 dropbear[1252]: Child connection from ::ffff:80.34.53.31:60495
Feb 11 15:23:17 dropbear[1252]: login attempt for nonexistent user from ::ffff:80.34.53.31:60495
Feb 11 15:23:18 dropbear[1252]: exit before auth: Disconnect received


This login attempts are happening every 2 or 3 seconds.... I have installed dropbear SSH-server on Oleg's 1.9.2.7-7b, all as described in macsat's tutorial (http://www.macsat.com/macsat/content/view/12/29/). All connections come from the same address every time.

What can I do to find out more about this?
WlanMan
12-02-2006, 14:37
Hi

So you got hit by a tool that trys to bruteforce your login data.
From internet i have seen this quite often, but the displayed mac adress implies this is comming from inside your network. possible a wlan wardriver or neighbour ?
You can use netwirk scanners now to look deeper what´s happening if you want, but first look into the connected stations list if there is a unsuspected user... :)

Greets
Wlanman
wtzm
12-02-2006, 15:23
the displayed mac adress implies this is comming from inside your network.
I disagree. This is a normal ip(v4)-address written in ipv6 style ("IPv4 mapped address").
ikerstges
12-02-2006, 17:48
Thanks! I will make sure to use 'strong' passwords and change them regularly.. :rolleyes:
tokyoturnip
25-02-2006, 04:13
Configure dropbear to only use public keys, then problem solved, never will be able to brute force a public key.
macsat
25-02-2006, 08:50
Not trying to do advertising, if the admins of this board thinks otherwise, please do let me know, I undestand your stand then :-)

BUT....I have a user that presented a solution here:
http://www.macsat.com/forum/index.php?topic=206.0

The reason for me posting the link, and not a copy-paste is for not to take the credit for Pjotreks work !
WlanMan
26-02-2006, 03:11
I disagree. This is a normal ip(v4)-address written in ipv6 style ("IPv4 mapped address").
Hrml, you´re right. I looked to quick and thought i see a mac adress, not ip6 stuff (that i hate nevertheless ;)).
Still, where is it coming from then ?

Greets