Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : what is this?

[fuse1982]

i saw user "tmp" tried to execute a command in my server, but i don't have this user "tmp", below is the security log for my server, does anyone have any idea what's going on?

2004:06:09-00:43:56: 218.186.85.31 has tried to log in 10 times, unsuccessfully, this time into admin's account ***
2004:06:09-00:44:09: 218.186.85.31 has tried to log in 11 times, unsuccessfully, this time into tmp's account ***
2004:06:09-00:44:26: 218.186.85.31 has tried to log in 12 times, unsuccessfully, this time into admin's account ***
2004:06:09-00:44:30: 218.186.85.31 has tried to log in 13 times, unsuccessfully, this time into admin's account ***
2004:06:09-00:44:34: 218.186.85.31 has tried to log in 14 times, unsuccessfully, this time into tmp's account ***
2004:06:09-00:44:41: 218.186.85.31 has tried to log in 15 times, unsuccessfully, this time into tmp's account ***
2004:06:09-06:51:49: *** User tmp tried to execute /CMD_SHOW_USER ***

and i'm recieving hundreds of bfd warning email these days, but what i don't understand is my IPF only blocked few of the IPs, again, any suggestion?

so far from what i read from apf deny hosts rules, there are only these IPs are blocked

217.230.58.199
83.117.11.91
212.144.105.254
217.226.74.155
212.144.41.216
172.184.91.181
83.152.110.227
62.251.112.50
83.155.65.157
218.56.95.38
83.154.83.83
172.180.129.148
61.187.243.174
81.49.139.193
200.95.18.240
81.97.88.192
219.136.91.8
80.145.179.1
81.53.198.232
82.82.186.144
80.14.113.44
213.251.115.59
130.39.90.18
62.214.32.109
84.97.128.69
172.183.99.237
217.95.213.56
82.51.172.230
82.226.12.125
213.44.216.140
212.194.159.204
212.179.93.207
38.117.12.50
80.121.14.96
80.118.106.130
220.173.255.78
81.37.100.168
218.19.148.36
80.181.248.120
217.227.246.228
172.176.169.191
test
217.84.124.87
194.206.224.131
84.135.4.207
61.176.252.66
83.135.80.162
217.95.158.133
194.129.129.222
200.95.9.44
80.14.200.4
220.186.129.48
80.130.171.241
213.23.224.50
217.227.87.123
222.139.22.218
217.235.163.220
80.130.8.168
219.131.44.117
80.32.66.96
218.85.203.25
218.85.215.251
218.85.208.205
222.95.18.138
217.95.148.229
62.167.196.105
217.227.50.251
217.255.40.114
81.50.117.243
81.98.76.120
80.146.100.137
84.135.241.146
80.146.106.24
217.227.149.39
212.160.1.16
202.104.251.36
81.243.214.24
69.54.40.130
202.114.88.96
guest
80.145.26.154
82.51.178.247
80.180.139.115
62.195.212.233
62.214.57.119
218.85.209.218
172.183.117.212
24.200.184.42
61.55.87.179
81.244.169.170
220.168.22.103
220.169.6.21
81.165.76.104
172.206.243.146
62.214.23.168
218.15.67.8
80.57.42.18
220.168.21.23
216.185.123.222
217.94.97.187
80.239.86.113
80.146.125.26
69.70.55.241
205.209.134.120
83.192.1.98
82.82.179.68
217.186.3.137
62.101.126.225
80.136.78.160
222.53.56.44
80.15.154.139
200.79.224.28
217.95.149.250
69.60.104.142
148.221.208.139
68.40.39.137
219.150.242.142
83.156.218.117
218.1.100.66
81.244.172.196
82.66.60.124
61.176.103.135
219.133.172.220
212.142.205.70
82.53.32.207
216.240.149.17
220.168.20.102
161.58.176.71
80.145.113.54
12.42.142.135
83.135.94.183
80.125.84.188
221.192.254.95
nobody
GNU nano 1.2.1 File: deny_hosts.rules Modified

patrick
69.93.104.250
62.214.60.148
217.93.55.123
213.118.37.156
217.88.154.128
211.248.38.252
216.41.96.222
64.62.194.170
frank
82.82.104.118
61.54.131.117
172.176.78.241
212.83.91.88
66.79.170.220
61.54.131.226
218.77.111.177
82.64.156.20
217.93.189.61
217.227.221.8
195.186.217.57
69.140.226.32
80.132.88.38
217.230.75.57
218.108.39.166
211.40.89.159
62.193.142.1
80.17.23.163
220.163.44.99
219.234.81.66
217

i'm pretty sad to see so many ppl are interested into hacking

[eWebtricity]

Looks like your getting "brute forced" on the admin account password, unless there are alot of the TMP msgs it might be the direct admin cp trying to do legitimate tasks.

[badger58]

Instead of just denying specific addresses, you should tell APF to deny all addresses access to ssh, telnet, etc, except for your own, or people who pay for that service.

I agree with eweb, looks like a brute force attack.

[eth00]

Since a few weeks ago there has been a rash of brute force attacks by a trojan. If you have kept the deny logs for awhile it is very possible to have a list that long. That is a lot, but it is probably not directed at your server specifically.

Make sure your root and admin password are secure. It would also be in your best interest to limit per ip if you can.

[andreyka]

Change ssh port or install BFD.