RE: Unknown Account: 5202 Time(s), Anyone notice an increase in Illegal user attempts
 

G'day Ladies and Gents,

Wondering if anyone is noticing an increase in login attempts a day on your servers?


Thanks

Mark

affirmative.... :S

It is just kids with brute force attack sripts.

They have been doing it for years and will continue to do it even when everyone ends up with Proxy Pass installed.

School is out. Kids are bored. You'll notice an increase now for a few weeks, then it will die out, then pick up in the middle of September as they get into computer classes and learn how to "h4ck".

I had two bruteforce attempts today.

Makes 110% sense :2 cents:

:upsidedow

Agreed... boredom is generally the cause of most destruction, where as drive and creativity can make something amazing. Except maybe the A bomb.

Kids + Boredom = Attempted Hacked Servers

Agreed... boredom is generally the cause of most destruction, where as drive and creativity can make something amazing. Except maybe the A bomb.

Kids + Boredom = Attempted Hacked Servers

Agreed... boredom is generally the cause of most destruction, where as drive and creativity can make something amazing. Except maybe the A bomb.

Kids + Boredom = Attempted Hacked Servers

They often hit on weekends and holidays a ton more.. They know most programs aren't watching for leaks.

Either way, yeah, we are getting attacked non stop the last few days.

It sucks big time. They do not get in, and we block them, but it still takes resources. Thousands of attempt a day :S

Thank you for your reply on the topic, I notice that on weekends there are more access attempts than on weekdays. I'll have to take some further measures to eliminate the potential of a server take over.

Here is a look at latest log watch;

sshd:
Invalid Users:
Unknown Account: 14975 Time(s)
Authentication Failures:
root ( blanked out ): 156 Time(s)

Thanks for your input.
Mark

why is your ssh available for connections from random addresses? it should be acl'ed down to your mgmt ips only. it should also run on a high non-standard port, like 16283 or something similar. get a clueful server admin.

I changed the ssh & sshd thanks for your input hotstuff!
Today was good with no attempts. Looks like they are not port scanning.
I know it still dosn't make me a clueful server admin, I love the learning curve im putting myself through.

Talk again soon maybe?
Mark

Agreed... boredom is generally the cause of most destruction, where as drive and creativity can make something amazing. Except maybe the A bomb.

Kids + Boredom = Attempted Hacked Servers