Results 1 to 9 of 9

Thread: A sort of attack...

  1. 23-09-2008, 21:22 #1
    Ciuflingar
    Ciuflingar is offline Junior Member
    Join Date
    Mar 2008
    Posts
    7

    A sort of attack...

    Hi,

    I have the last version from olegs firmware on my asus wl500gP.
    I set connection limit to "2" and I cannot connect to my FTP because connection limit is reached.

    It seems that there is somebody connected because I have in my sys logs the folowing lines...

    Is there anybody that knows how I can stop/block this "211.48.190.67" IP?
    Is there anything as spam blocker beside firewall...?

    Code:
    vsftpd[17532]: CONNECT: Client "211.48.190.67"
Sep 23 22:43:41 vsftpd[17531]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 22:43:43 vsftpd[17531]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 22:43:45 vsftpd[17531]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 22:43:46 vsftpd[17534]: CONNECT: Client "211.48.190.67"
Sep 23 22:43:47 vsftpd[17533]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 22:43:49 vsftpd[17533]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 22:43:50 vsftpd[17533]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 22:43:52 vsftpd[17536]: CONNECT: Client "211.48.190.67"
Sep 23 22:43:53 vsftpd[17535]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 22:43:54 vsftpd[17535]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
..........................
.........................
..........................
vsftpd[18443]: CONNECT: Client "211.48.190.67"
Sep 23 23:03:40 vsftpd[18442]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 23:03:42 vsftpd[18442]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 23:03:44 vsftpd[18442]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 23:03:45 vsftpd[18445]: CONNECT: Client "211.48.190.67"
Sep 23 23:03:46 vsftpd[18444]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 23:03:48 vsftpd[18444]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 23:03:49 vsftpd[18444]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 23:03:51 vsftpd[18447]: CONNECT: Client "211.48.190.67"
Sep 23 23:03:52 vsftpd[18446]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 23:03:53 vsftpd[18446]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
Sep 23 23:03:55 vsftpd[18446]: [Administrator] FAIL LOGIN: Client "211.48.190.67"
    Reply With Quote Reply With Quote
  2. 23-09-2008, 21:46 #2
    raas
    raas is offline Forum Guru
    Join Date
    Jul 2007
    Posts
    610
    Hi,

    a couple of days ago The_29 suggested a solution which can be found here: http://www.wl500g.info/showthread.php?t=16105
    WL500g Premium v1 Oleg 1.9.2.7-10 500gb hdd [storage-disk] - 250gb hdd [download-disk]
    Transmission HellaNZB mysql php lighttpd myphpadmin samba AIOCP CMSimple AmpJuke ADOS
    HeadStart
    How to measure Energy consumption
    Reply With Quote Reply With Quote
  3. 24-09-2008, 15:44 #3
    Kenny
    Kenny is offline Member
    Join Date
    Jul 2008
    Posts
    51
    i'm encoutering the same type of problem but through dropbear
    Code:
    Sep 24 11:06:04 dropbear[11737]: login attempt for nonexistent user from ::ffff:210.207.177.231:51565
Sep 24 11:06:05 dropbear[11737]: exit before auth: Disconnect received
Sep 24 11:06:08 dropbear[11744]: login attempt for nonexistent user from ::ffff:210.207.177.231:51718
Sep 24 11:06:10 dropbear[11744]: exit before auth: Disconnect received
Sep 24 11:06:13 dropbear[11745]: login attempt for nonexistent user from ::ffff:210.207.177.231:51877
Sep 24 11:06:15 dropbear[11745]: exit before auth: Disconnect received
Sep 24 11:06:18 dropbear[11746]: login attempt for nonexistent user from ::ffff:210.207.177.231:52035
Sep 24 11:06:19 dropbear[11746]: exit before auth: Disconnect received
Sep 24 11:06:23 dropbear[11747]: login attempt for nonexistent user from ::ffff:210.207.177.231:52194
Sep 24 11:06:24 dropbear[11747]: exit before auth: Disconnect received
Sep 24 11:06:28 dropbear[11748]: login attempt for nonexistent user from ::ffff:210.207.177.231:52354
Sep 24 11:06:30 dropbear[11748]: exit before auth: Disconnect received
Sep 24 11:06:34 dropbear[11749]: login attempt for nonexistent user from ::ffff:210.207.177.231:52513
Sep 24 11:06:35 dropbear[11749]: exit before auth: Disconnect received
    any help is appreciated
    Reply With Quote Reply With Quote
  4. 24-09-2008, 18:42 #4
    raas
    raas is offline Forum Guru
    Join Date
    Jul 2007
    Posts
    610
    Kenny,

    the solution in post #2 should also work for you.

    further you have port 22/23 open to the internet.
    If you don't really need it, (putty access from somewhere else (the internet) than your house), close it.
    WL500g Premium v1 Oleg 1.9.2.7-10 500gb hdd [storage-disk] - 250gb hdd [download-disk]
    Transmission HellaNZB mysql php lighttpd myphpadmin samba AIOCP CMSimple AmpJuke ADOS
    HeadStart
    How to measure Energy consumption
    Reply With Quote Reply With Quote
  5. 24-09-2008, 19:42 #5
    al37919
    al37919 is offline Forum Guru
    Join Date
    Feb 2007
    Location
    Moscow, Russia
    Posts
    3,805
    These problems can be solved also using ipt_recent module of the iptables
    Reply With Quote Reply With Quote
  6. 24-09-2008, 22:34 #6
    wpte
    wpte is offline Student Computer Engineer
    Join Date
    Dec 2007
    Location
    The Netherlands - Eindhoven
    Posts
    1,767
    iprecent never worked for me...
    you can also try portforwarding on different ports
    most hackers are stupid and just scan for obvious ports, so if you change them to some random ports, it's not likely to be noticed.
    every program does send it's signature tho, so with an advanced scanner you can see wheather its ftp or dropbear.
    Reply With Quote Reply With Quote
  7. 25-09-2008, 08:24 #7
    al37919
    al37919 is offline Forum Guru
    Join Date
    Feb 2007
    Location
    Moscow, Russia
    Posts
    3,805
    Quote Originally Posted by wpte View Post
    iprecent never worked for me...
    However, for me it works pretty well At least for ssh.
    Here I described my experience (in Russian, and in German )
    http://wl500g.info/showpost.php?p=69964&postcount=63
    http://wl500g.info/showpost.php?p=86141&postcount=7
    Reply With Quote Reply With Quote
  8. 25-09-2008, 12:29 #8
    Kenny
    Kenny is offline Member
    Join Date
    Jul 2008
    Posts
    51
    finally i used the "dropbear-s" solution, is it the most secure of all?
    Reply With Quote Reply With Quote
  9. 12-10-2008, 16:22 #9
    gouryella
    gouryella is offline Senior Member
    Join Date
    Sep 2007
    Location
    czech republic
    Posts
    182

    hi

    Im using another port of dropbear with best results no attacks on SSH from the internet:
    Code:
    dropbear -p 123
    do not forgot change the port in putty / or create forwarding and deny SSH from web
    Code:
    iptables -t nat -A PREROUTING -i $1 -p tcp --dport 123 -j DNAT --to-destination $4:22
    Last edited by gouryella; 12-10-2008 at 16:25.
    RT-N13u dd-wrt | Toshiba 2.5" 160GB | pxe boot server
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Similar Threads

  1. HP LaserJet 1000/1005/1020 not working: sort of solution
    By pardonfiu in forum WL-500g Q&A
    Replies: 81
    Last Post: 06-12-2014, 11:20
  2. Internet working - sort of...
    By DivadLarsen in forum WL-500gP Q&A
    Replies: 0
    Last Post: 29-08-2008, 19:14
  3. HP LaserJet 1000 not working on lan with all client winxp pro: sort of solution
    By zukkaweb in forum WL-500gP Q&A
    Replies: 10
    Last Post: 06-10-2007, 12:54

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules