SSH attack

biosedit

Marty        
<martyb@ix.netcom.com> to Debian-Users
         More options          2:14 am (15 hours ago)
Jared Hall wrote:
> It looks like I am being rooted right now.  How do I toss this guy off
> of my system.  he has an IP address of 210.95.212.131

It's a kid!  Whois returns "Hanguk Kwangsan Technoledge High School."



--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org


  ReplyReply to allForwardInvite Marty to Gmail
               
               
Pollywog        
<linux-debian@shadypond.com> to debian-user
         More options          2:23 am (15 hours ago)
On 10/03/2005 06:14 pm, Marty wrote:
> Jared Hall wrote:
> > It looks like I am being rooted right now.  How do I toss this guy off
> > of my system.  he has an IP address of 210.95.212.131
>
> It's a kid!  Whois returns "Hanguk Kwangsan Technoledge High School."

I get lots of those, often from Asia and S. America.  Block the IP at the
firewall.  If you install Portsentry, you can have Portsentry block them
automatically using iptables.  IIRC you can have a list of IP addresses that
are exempt from blocking.
Asia and S. America