ssh security
Bajan Ferenc
bferi at calypso.tbsz.sulinet.hu
2010. Feb. 1., H, 09:20:55 CET
Helló!
Chrootolt sftp kialakítása közben néztem meg a naplókat. 2009. márciusa
óta az egyik szerverünkön uszkve 530000 belépési kísérlet történt, 4751
különböző címről. Többségükről egy-kettő, 10 fölött 1223 címről, 100
fölött 378 címről. A toplista, a felső tízezer:
---------------------
11411 196.29.212.158
% This is the AfriNIC Whois server.
% Note: this output has been filtered.
% Information related to '196.29.212.0 - 196.29.215.255'
inetnum: 196.29.212.0 - 196.29.215.255
netname: DIRECTONPC-WIRELESS-ISP-NETBLK
descr: Internet Data Center Services for DOPC
country: NG
admin-c: IP1-AFRINIC
tech-c: IP1-AFRINIC
status: ASSIGNED PA
mnt-by: DOPCNG-MNT
mnt-lower: DOPCNG-MNT
source: AFRINIC # Filtered
parent: 196.29.212.0 - 196.29.223.255
person: IP Administrator
address: Direct-on-PC Limited
address: Plot B, Block 1
address: Illupeju Industrial avenue
address: Illupeju
address: Lagos
address: Nigeria
address: NG
phone: +234-1-2701700
fax-no: +234-1-2713554
e-mail: hostmaster at directonpc.com
org: ORG-DOP1-AFRINIC
nic-hdl: IP1-AFRINIC
mnt-by: DOPCNG-MNT
source: AFRINIC # Filtered
-----------------------
11796 128.143.199.159
OrgName: University of Virginia
OrgID: UVA
Address: University of Virginia, ITC
Address: P.O. Box 400324
City: Charlottesville
StateProv: VA
PostalCode: 22904-4324
Country: US
NetRange: 128.143.0.0 - 128.143.255.255
CIDR: 128.143.0.0/16
NetName: VIRGINIA
NetHandle: NET-128-143-0-0-1
Parent: NET-128-0-0-0-0
NetType: Direct Assignment
NameServer: UVAARPA.VIRGINIA.EDU
NameServer: JUNO.ACC.VIRGINIA.EDU
NameServer: NOM.VIRGINIA.EDU
Comment: University of Virginia Abuse Team
RegDate: 1987-12-14
Updated: 2002-11-26
RAbuseHandle: ABUSE124-ARIN
RAbuseName: Abuse Team
RAbusePhone: +1-434-924-3731
RAbuseEmail: abuse at virginia.edu
RTechHandle: JAJ17-ARIN
RTechName: Jokl, James A.
RTechPhone: +1-804-924-0616
RTechEmail: jaj at virginia.edu
OrgAbuseHandle: ABUSE124-ARIN
OrgAbuseName: Abuse Team
OrgAbusePhone: +1-434-924-3731
OrgAbuseEmail: abuse at virginia.edu
OrgTechHandle: JAJ17-ARIN
---------------------
12177 222.236.47.48
# ENGLISH
KRNIC is not an ISP but a National Internet Registry similar to APNIC.
The following is organization information that is using the IPv4 address.
IPv4 Address : 222.236.0.0-222.236.63.255
Network Name : HANANET-INFRA
Connect ISP Name : broadNnet
Connect Date : 20050328
Registration Date : 20050329
Publishes : Y
[ Organization Information ]
Organization ID : ORG3930
Org Name : SK Broadband Co Ltd
Address : Seoul Namdaemunno 5(o)-ga Jung-gu SK NamsanGreen
Bldg.
Detail Address : 267
Zip Code : 100-711
[ Technical Contact Information ]
Name : IP manager
Org Name : SK Broadband Co Ltd
Address : Seoul Namdaemunno 5(o)-ga Jung-gu SK NamsanGreen
Bldg.
Detail Address : 267
Zip Code : 100-711
Phone : +82-2-106-2
E-Mail : ip-adm at skbroadband.com
----------------------
14297 91.143.212.221
% Information related to '91.143.212.192 - 91.143.212.255'
inetnum: 91.143.212.192 - 91.143.212.255
netname: HEAVYNETWORKS-NET
descr: Heavy Networks, Sime Igumanova 18, 11000 Beograd, SRB
country: CS
admin-c: NS1911-RIPE
tech-c: AOK7-RIPE
remarks: rev-srv: ns1.absolutok.com
remarks: rev-srv: ns2.absolutok.com
status: ASSIGNED PA
mnt-by: ABSOLUTOK-MNT
source: RIPE # Filtered
remarks: rev-srv attribute deprecated by RIPE NCC on 02/09/2009
person: Nikola Slijepcevic
address: Sime Igumanova 18, 11000 Beograd, SRB
phone: +381 11 2161346
fax-no: +381 11 2161346
e-mail: office at heavynetworks.tv
nic-hdl: NS1911-RIPE
source: RIPE # Filtered
person: AbsolutOK NOC
address: Palmira Toljatija 5/3, 11070 Novi Beograd, SCG
phone: +381 11 2016700
fax-no: +381 11 2016717
e-mail: dns at absolutok.com
nic-hdl: AOK7-RIPE
mnt-by: ABSOLUTOK-MNT
source: RIPE # Filtered
-----------------------
18744 207.234.184.219
Affinity Internet, Inc AFFINITY-207-234-128-0 (NET-207-234-128-0-1)
207.234.128.0 - 207.234.255.255
Affinity Internet, Inc AFFI-DEDICATED-207-234-181-0 (NET-207-234-181-0-1)
207.234.181.0 - 207.234.184.255
# ARIN WHOIS database, last updated 2010-01-31 20:00
# Enter ? for additional hints on searching ARIN's WHOIS database.
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at https://www.arin.net/whois_tou.html
---------------------
21816 88.198.87.145
% Information related to '88.198.87.144 - 88.198.87.151'
inetnum: 88.198.87.144 - 88.198.87.151
netname: NAJDMEN
descr: Najdmen
country: DE
admin-c: PN2247-RIPE
tech-c: PN2247-RIPE
status: ASSIGNED PA
mnt-by: HOS-GUN
source: RIPE # Filtered
person: Pawel Najdek
address: Najdmen
address: Ujejskiego 6/11
address: 30-102 Krakow
address: POLAND
phone: +48664266554
nic-hdl: PN2247-RIPE
remarks: Najdmen
remarks: Ujejskiego 6/11
remarks: 30-102 Krakow
remarks: POLAND
abuse-mailbox: abuse at najdmen.pl
mnt-by: HOS-GUN
source: RIPE # Filtered
----------------------
31766 87.120.247.194
% Information related to '87.120.247.0 - 87.120.247.255'
inetnum: 87.120.247.0 - 87.120.247.255
netname: NETGUARD
descr: NetGuard Ltd.
country: BG
admin-c: NS1590-RIPE
tech-c: NS1590-RIPE
status: ASSIGNED PA
mnt-by: MNT-NETERRA
mnt-routes: NETGUARDBG-MNT
mnt-domains: NETGUARDBG-MNT
source: RIPE # Filtered
person: Nikolai Semerdjiev
address: 69 Maria Luiza Blvd.
address: Plovdiv 4000
address: BG
e-mail: nss at NETGUARD.bg
phone: +359 32 510 115
nic-hdl: NS1590-RIPE
source: RIPE # Filtered
mnt-by: NETGUARDBG-MNT
% Information related to '87.120.247.0/24AS39251'
route: 87.120.247.0/24
descr: NETGUARD BG Ltd
origin: AS39251
mnt-by: NETGUARDBG-MNT
source: RIPE # Filtered
Utóbbi okt. 27. 22 órától kb. 1-5 másodpercenként próbálkozott 4500
különböző névvel.
Szerintetek érdemes jelezni a megadott abuse címeken?
--
---------------------------------------------------------------------
Bajan Ferenc
További információk a(z) Techinfo levelezőlistáról