Hello. My provider gives two protocols type: PPPoE(Internet) and Static IP (Local Resource). What should i do to use both of them together?
Thanks
I have set my router to WAN Acces.
but to day i saw in my log file :
Apr 10 06:02:05 dropbear[1172]: exit before auth: Disconnect received
Apr 10 06:02:06 dropbear[1173]: login attempt for nonexistent user from 194.169.227.233:41438
Apr 10 06:02:07 dropbear[1173]: exit before auth: Disconnect received
Apr 10 06:02:08 dropbear[1174]: login attempt for nonexistent user from 194.169.227.233:41649
etc. etc etc.
does this means some is trying to login in to my router, at random port numbers ????
because there are several attemps with diffrent port numbers.
greetings Rick
This is what i get. Can someone please tell me what it means?
Apr 13 06:34:20 dropbear[9718]: Child connection from 202.100.82.230:57558
Apr 13 06:34:30 dropbear[9718]: exit before auth: Failed to get remote version
Apr 13 06:40:59 dropbear[9731]: Child connection from 202.100.82.230:60421
Apr 13 06:41:02 dropbear[9732]: Child connection from 202.100.82.230:60514
Apr 13 06:41:05 dropbear[9733]: Child connection from 202.100.82.230:60663
Apr 13 06:41:05 dropbear[9731]: bad password attempt for 'root' from 202.100.82.230:60421
Apr 13 06:41:07 dropbear[9731]: exit before auth (user 'root', 1 fails): Disconnect received
Apr 13 06:41:07 dropbear[9734]: Child connection from 202.100.82.230:60803
Apr 13 06:41:08 dropbear[9735]: Child connection from 202.100.82.230:60837
Apr 13 06:41:11 dropbear[9738]: Child connection from 202.100.82.230:32840
Apr 13 06:41:12 dropbear[9732]: exit before auth: Exited normally
Apr 13 06:41:13 dropbear[9735]: bad password attempt for 'root' from 202.100.82.230:60837
Apr 13 06:41:13 dropbear[9735]: exit before auth (user 'root', 1 fails): Disconnect received
Apr 13 06:41:14 dropbear[9739]: Child connection from 202.100.82.230:33101
Apr 13 06:41:15 dropbear[9734]: bad password attempt for 'root' from 202.100.82.230:60803
Apr 13 06:41:16 dropbear[9733]: exit before auth: Failed to get remote version
Apr 13 06:41:16 dropbear[9734]: exit before auth (user 'root', 1 fails): Disconnect received
Apr 13 06:41:17 dropbear[9740]: Child connection from 202.100.82.230:33370
Apr 13 06:41:17 dropbear[9741]: Child connection from 202.100.82.230:33402
Apr 13 06:41:18 dropbear[9742]: Child connection from 202.100.82.230:33093
Apr 13 06:41:19 dropbear[9739]: bad password attempt for 'root' from 202.100.82.230:33101
Apr 13 06:41:20 dropbear[9739]: exit before auth (user 'root', 1 fails): Disconnect received
Apr 13 06:41:20 dropbear[9743]: Child connection from 202.100.82.230:33708
Apr 13 06:41:22 dropbear[9738]: exit before auth: Failed to get remote version
Apr 13 06:41:22 dropbear[9741]: login attempt for nonexistent user from 202.100.82.230:33402
Apr 13 06:41:23 dropbear[9741]: exit before auth: Disconnect received
Apr 13 06:41:23 dropbear[9744]: Child connection from 202.100.82.230:34076
Apr 13 06:41:25 dropbear[9740]: bad password attempt for 'root' from 202.100.82.230:33370
Apr 13 06:41:26 dropbear[9745]: Child connection from 202.100.82.230:34422
Apr 13 06:41:27 dropbear[9740]: exit before auth (user 'root', 1 fails): Exited normally
Apr 13 06:41:28 dropbear[9746]: Child connection from 202.100.82.230:34183
Apr 13 06:41:29 dropbear[9743]: login attempt for nonexistent user from 202.100.82.230:33708
Apr 13 06:41:30 dropbear[9743]: exit before auth: Exited normally
Apr 13 06:41:32 dropbear[9747]: Child connection from 202.100.82.230:35189
Apr 13 06:41:33 dropbear[9746]: login attempt for nonexistent user from 202.100.82.230:34183
Apr 13 06:41:34 dropbear[9744]: exit before auth: Failed to get remote version
Apr 13 06:41:34 dropbear[9746]: exit before auth: Exited normally
Apr 13 06:41:35 dropbear[9748]: Child connection from 202.100.82.230:35582
Apr 13 06:41:37 dropbear[9745]: exit before auth: Failed to get remote version
Apr 13 06:41:39 dropbear[9749]: Child connection from 202.100.82.230:35970
Apr 13 06:41:39 dropbear[9742]: exit before auth: Failed to get remote version
Apr 13 06:41:42 dropbear[9748]: login attempt for nonexistent user from 202.100.82.230:35582
Apr 13 06:41:43 dropbear[9747]: exit before auth: Failed to get remote version
Apr 13 06:41:43 dropbear[9748]: exit before auth: Disconnect received
Apr 13 06:41:44 dropbear[9749]: login attempt for nonexistent user from 202.100.82.230:35970
Apr 13 06:41:44 dropbear[9752]: Child connection from 202.100.82.230:36634
Apr 13 06:41:45 dropbear[9753]: Child connection from 202.100.82.230:36358
Apr 13 06:41:45 dropbear[9749]: exit before auth: Disconnect received
Apr 13 06:41:45 dropbear[9754]: Child connection from 202.100.82.230:36768
Apr 13 06:41:45 dropbear[9755]: Child connection from 202.100.82.230:36888
Apr 13 06:41:48 dropbear[9756]: Child connection from 202.100.82.230:37160
Apr 13 06:41:49 dropbear[9752]: login attempt for nonexistent user from 202.100.82.230:36634
Apr 13 06:41:50 dropbear[9752]: exit before auth: Disconnect received
Apr 13 06:41:51 dropbear[9758]: Child connection from 202.100.82.230:37511
Apr 13 06:41:51 dropbear[9754]: login attempt for nonexistent user from 202.100.82.230:36768
Apr 13 06:41:52 dropbear[9754]: exit before auth: Disconnect received
Apr 13 06:41:53 dropbear[9759]: Child connection from 202.100.82.230:37805
Apr 13 06:41:53 dropbear[9753]: exit before auth: Exited normally
Apr 13 06:41:54 dropbear[9760]: Child connection from 202.100.82.230:37928
Apr 13 06:41:58 dropbear[9759]: login attempt for nonexistent user from 202.100.82.230:37805
Apr 13 06:41:59 dropbear[9759]: exit before auth: Disconnect received
Apr 13 06:42:00 dropbear[9761]: Child connection from 202.100.82.230:38663
Apr 13 06:42:06 dropbear[9755]: exit before auth: Failed to get remote version
Apr 13 06:42:08 dropbear[9756]: exit before auth: Failed to get remote version
Apr 13 06:42:10 dropbear[9762]: Child connection from 202.100.82.230:39878
Apr 13 06:42:10 dropbear[9763]: Child connection from 202.100.82.230:39485
Apr 13 06:42:11 dropbear[9758]: exit before auth: Failed to get remote version
Apr 13 06:42:13 dropbear[9764]: Child connection from 202.100.82.230:40255
Apr 13 06:42:16 dropbear[9760]: exit before auth: Failed to get remote version
Apr 13 06:42:16 dropbear[9762]: login attempt for nonexistent user from 202.100.82.230:39878
Apr 13 06:42:17 dropbear[9762]: exit before auth: Disconnect received
Apr 13 06:42:17 dropbear[9763]: exit before auth: Exited normally
Apr 13 06:42:19 dropbear[9766]: Child connection from 202.100.82.230:41018
Apr 13 06:42:20 dropbear[9767]: Child connection from 202.100.82.230:40915
Apr 13 06:42:21 dropbear[9761]: exit before auth: Failed to get remote version
Apr 13 06:42:22 dropbear[9768]: Child connection from 202.100.82.230:41428
Apr 13 06:42:28 dropbear[9769]: Child connection from 202.100.82.230:41796
Apr 13 06:42:28 dropbear[9767]: exit before auth: Exited normally
Apr 13 06:42:31 dropbear[9770]: Child connection from 202.100.82.230:42568
Apr 13 06:42:32 dropbear[9768]: exit before auth: Failed to get remote version
Apr 13 06:42:33 dropbear[9764]: exit before auth: Failed to get remote version
Apr 13 06:42:34 dropbear[9771]: Child connection from 202.100.82.230:42962
Apr 13 06:42:37 dropbear[9772]: Child connection from 202.100.82.230:43336
Apr 13 06:42:39 dropbear[9769]: exit before auth: Failed to get remote version
Apr 13 06:42:39 dropbear[9771]: login attempt for nonexistent user from 202.100.82.230:42962
Apr 13 06:42:40 dropbear[9771]: exit before auth: Disconnect received
Apr 13 06:42:40 dropbear[9773]: Child connection from 202.100.82.230:43719
Apr 13 06:42:40 dropbear[9774]: Child connection from 202.100.82.230:43798
Apr 13 06:42:41 dropbear[9770]: exit before auth: Exited normally
Apr 13 06:42:43 dropbear[9775]: Child connection from 202.100.82.230:44109
Apr 13 06:42:44 dropbear[9772]: login attempt for nonexistent user from 202.100.82.230:43336
Apr 13 06:42:45 dropbear[9772]: exit before auth: Disconnect received
Apr 13 06:42:46 dropbear[9776]: Child connection from 202.100.82.230:44434
Apr 13 06:42:49 dropbear[9766]: exit before auth: Failed to get remote version
Apr 13 06:42:49 dropbear[9777]: Child connection from 202.100.82.230:44874
Apr 13 06:42:50 dropbear[9773]: exit before auth: Failed to get remote version
Apr 13 06:42:51 dropbear[9774]: exit before auth: Failed to get remote version
Apr 13 06:42:52 dropbear[9778]: Child connection from 202.100.82.230:45255
Apr 13 06:42:54 dropbear[9775]: exit before auth: Failed to get remote version
Apr 13 06:42:56 dropbear[9779]: Child connection from 202.100.82.230:45637
Apr 13 06:42:57 dropbear[9776]: exit before auth: Failed to get remote version
Apr 13 06:42:59 dropbear[9780]: Child connection from 202.100.82.230:45992
Apr 13 06:43:02 dropbear[9781]: Child connection from 202.100.82.230:46380
Apr 13 06:43:04 dropbear[9778]: exit before auth: Exited normally
Apr 13 06:43:05 dropbear[9783]: Child connection from 202.100.82.230:46757
Apr 13 06:43:10 dropbear[9780]: exit before auth: Exited normally
Apr 13 06:43:14 dropbear[9784]: Child connection from 202.100.82.230:47544
Apr 13 06:43:16 dropbear[9779]: exit before auth: Failed to get remote version
Apr 13 06:43:17 dropbear[9785]: Child connection from 202.100.82.230:48299
Apr 13 06:43:20 dropbear[9777]: exit before auth: Failed to get remote version
Apr 13 06:43:20 dropbear[9786]: Child connection from 202.100.82.230:48653
Apr 13 06:43:22 dropbear[9781]: exit before auth: Failed to get remote version
Apr 13 06:43:23 dropbear[9787]: Child connection from 202.100.82.230:49069
Apr 13 06:43:25 dropbear[9784]: exit before auth: Failed to get remote version
Apr 13 06:43:29 dropbear[9787]: bad password attempt for 'root' from 202.100.82.230:49069
Apr 13 06:43:29 dropbear[9788]: Child connection from 202.100.82.230:49445
Apr 13 06:43:30 dropbear[9787]: exit before auth (user 'root', 1 fails): Disconnect received
Apr 13 06:43:31 dropbear[9786]: exit before auth: Failed to get remote version
Apr 13 06:43:33 dropbear[9789]: Child connection from 202.100.82.230:50240
Apr 13 06:43:34 dropbear[9790]: Child connection from 202.100.82.230:50029
Apr 13 06:43:36 dropbear[9783]: exit before auth: Failed to get remote version
Apr 13 06:43:38 dropbear[9785]: exit before auth: Failed to get remote version
Apr 13 06:43:39 dropbear[9791]: Child connection from 202.100.82.230:50633
Apr 13 06:43:41 dropbear[9790]: exit before auth: Exited normally
Thanks in advance.
Could you do some investigation yourself?
Maybe login with ssh and try a random password for root, what does the log then say?
Maybe you could conclude then that someone evil is trying to get in!
Maybe you could edit your loooooooong quote a bit and make it shrtr.
Marc
gingishan1
Your being Hacked.
Happens a lot.
Ensure you keep dropbear with password on and look at settings for your VSFTPD sometimes they will try to get in that way as well.
If your additionally worried install fail2ban as an additional measure.
I want to start Dovecot automatic at boot up.
How can I do that in rc.local.
I tryed this several times, different ways but it won't start.
When I start Dovecot manual it works fine.
Someone there who can help me.
Gr. Ronald
Dear KFurge,
Can you tell why the Asus takes so long to reach the point where the ready light blinks? It takes a mere 3 minutes. Is it busy to check the filesystem, or what?
Also, is it possible (in the next relaese) to get rid of the first telnet deamon? It is unsafe, and it confuses many people when 'you' start the safer version. This counts more because it takes so long to boot.
And why is the ready light on, long before it executes my rc.local? What does ready mean here?
Ok, questions you might not know answers for, but I'll appreciate it if you have some.
Another question. When I log in as myself (admin), I have KCSHELL as variable, because I made a .profile in /opt/home/marc. I also did this for root, that has /opt/home/root as home dir. Now with sudo bash -l I have KCSHELL as root. But, you guess, after rebooting the home-dir of root is changed to /, no .profile is executed, and hence I don't have KCSHELL after sudo bash -l.
I found that /opt/etc/init.kc/fix_passwd.sh is to blame...
Regards
Marc
Last edited by mumsoft; 25-03-2008 at 21:28. Reason: another question