This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Scary event in exec report

While checking out my daily executive report I ran across this:

Remote logins (success/failed)        1 / 3383

Then I went to hunt down the definition of a "Remote login".  Guess what? I came up empty.

Since I run with my webadmin and ssh wide open (I don't know where I'm going to be coming from a lot of the time.) I didn't know if it was from webadmin or ssh.

Turns out since I'm running with "block password guessing" it couldn't be from webadmin (unless someone was using an anonymous proxy).  So I've determined it's from ssh.

Where can I find the logs that show this activiity so I can investigate the IP address?

Is this analysis of Remote Login accurate?

Thanks,

.dn

This thread was automatically locked due to age.

0 William Warren over 21 years ago

there is a recent increase in remote ssh scanning trying various kernel exploits. I would turn off ssh to the outside world until this dies down. I am also assuming the latest kernel vulns may or may not affect Astaro. I know they harden it..but if you are letting SSH open to the world then if they figure out your ssh login password then your root pasword these now become local exploits to the machine.
Astaro, What is the status of vulnerability..or non-vulnerability to the following exploits in the linux kernel? I am not trying to scare anyone..just curious as some of these could compromise a astaro machine through ssh:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0495
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0535
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0497
Cancel
Vote Up 0 Vote Down

Cancel