<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
Hola.. buen unas notas...<br>
<br>
1. No quiero bloquear toda rusia... algunos de mis clientes tiene
negocios con rusia...<br>
2. que tan efectivo es eso?...<br>
<br>
Por cierto.. ultimamente se han estado tratando de encontrar el root:<br>
<br>
<pre>Jun 7 10:24:14 cl-t030-261cl sshd[12994]: Failed password for root from 218.234.33.31 port 46101 ssh2
Jun 7 10:24:14 cl-t030-261cl sshd[12995]: Received disconnect from 218.234.33.31: 11: Bye Bye
Jun 7 10:24:17 cl-t030-261cl sshd[12997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.234.33.31 user=root
Jun 7 10:24:19 cl-t030-261cl sshd[12997]: Failed password for root from 218.234.33.31 port 46398 ssh2
Jun 7 10:24:20 cl-t030-261cl sshd[12998]: Received disconnect from 218.234.33.31: 11: Bye Bye
Jun 7 10:24:23 cl-t030-261cl sshd[13012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.234.33.31 user=root
Jun 7 10:24:25 cl-t030-261cl sshd[13012]: Failed password for root from 218.234.33.31 port 46730 ssh2
Jun 7 10:24:25 cl-t030-261cl sshd[13013]: Received disconnect from 218.234.33.31: 11: Bye Bye
Jun 7 10:24:28 cl-t030-261cl sshd[13014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.234.33.31 user=root
Jun 7 10:24:30 cl-t030-261cl sshd[13014]: Failed password for root from 218.234.33.31 port 47084 ssh2
Jun 7 10:24:30 cl-t030-261cl sshd[13015]: Received disconnect from 218.234.33.31: 11: Bye Bye
Jun 7 10:24:33 cl-t030-261cl sshd[13022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.234.33.31 user=root
Jun 7 10:24:35 cl-t030-261cl sshd[13022]: Failed password for root from 218.234.33.31 port 47422 ssh2
Jun 7 10:24:36 cl-t030-261cl sshd[13023]: Received disconnect from 218.234.33.31: 11: Bye Bye
Jun 7 10:24:38 cl-t030-261cl sshd[13024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.234.33.31 user=root
Jun 7 10:24:40 cl-t030-261cl sshd[13024]: Failed password for root from 218.234.33.31 port 47752 ssh2
Jun 7 10:24:41 cl-t030-261cl sshd[13025]: Received disconnect from 218.234.33.31: 11: Bye Bye
seguido de un monton de estos:
Jun 7 13:50:55 cl-t030-261cl sshd[32537]: Invalid user data from 189.19.82.231
Jun 7 13:50:55 cl-t030-261cl sshd[32539]: input_userauth_request: invalid user data
Jun 7 13:50:55 cl-t030-261cl sshd[32537]: pam_unix(sshd:auth): check pass; user unknown
Jun 7 13:50:55 cl-t030-261cl sshd[32537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-19-82-231.dsl.telesp.net.br
Jun 7 13:50:55 cl-t030-261cl sshd[32537]: pam_succeed_if(sshd:auth): error retrieving information about user data
Jun 7 13:50:58 cl-t030-261cl sshd[32537]: Failed password for invalid user data from 189.19.82.231 port 50966 ssh2
y tambien muchos de estos:
Jun 7 13:51:34 cl-t030-261cl sshd[32582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-19-82-231.dsl.telesp.net.br user=admin
Jun 7 13:51:36 cl-t030-261cl sshd[32582]: Failed password for admin from 189.19.82.231 port 52409 ssh2
y de estos:
Jun 7 14:10:02 cl-t030-261cl su: pam_unix(su:session): session opened for user postgres by (uid=0)
Jun 7 14:10:02 cl-t030-261cl su: pam_unix(su:session): session closed for user postgres
Jun 7 14:15:03 cl-t030-261cl su: pam_unix(su:session): session opened for user postgres by (uid=0)
Y claro.. un escaneo en forma alfabetica:
Jun 7 13:34:05 cl-t030-261cl sshd[30466]: Invalid user alex from 189.19.82.231
Jun 7 13:34:05 cl-t030-261cl sshd[30467]: input_userauth_request: invalid user alex
Jun 7 13:34:05 cl-t030-261cl sshd[30466]: pam_unix(sshd:auth): check pass; user unknown
Jun 7 13:34:05 cl-t030-261cl sshd[30466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-19-82-231.dsl.telesp.net.br
Jun 7 13:34:05 cl-t030-261cl sshd[30466]: pam_succeed_if(sshd:auth): error retrieving information about user <b>alex</b>
Jun 7 13:34:07 cl-t030-261cl sshd[30466]: Failed password for invalid user alex from 189.19.82.231 port 40596 ssh2
Jun 7 13:34:07 cl-t030-261cl sshd[30467]: Received disconnect from 189.19.82.231: 11: Bye Bye
Jun 7 13:34:09 cl-t030-261cl sshd[30478]: Invalid user alien from 189.19.82.231
Jun 7 13:34:09 cl-t030-261cl sshd[30479]: input_userauth_request: invalid user alien
Jun 7 13:34:09 cl-t030-261cl sshd[30478]: pam_unix(sshd:auth): check pass; user unknown
Jun 7 13:34:09 cl-t030-261cl sshd[30478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-19-82-231.dsl.telesp.net.br
Jun 7 13:34:09 cl-t030-261cl sshd[30478]: pam_succeed_if(sshd:auth): error retrieving information about user <b>alien</b>
Jun 7 13:34:11 cl-t030-261cl sshd[30478]: Failed password for invalid user alien from 189.19.82.231 port 40738 ssh2
Jun 7 13:34:12 cl-t030-261cl sshd[30479]: Received disconnect from 189.19.82.231: 11: Bye Bye
Jun 7 13:34:13 cl-t030-261cl sshd[30482]: Invalid user alpuser from 189.19.82.231
Jun 7 13:34:13 cl-t030-261cl sshd[30483]: input_userauth_request: invalid user alpuser
Jun 7 13:34:13 cl-t030-261cl sshd[30482]: pam_unix(sshd:auth): check pass; user unknown
Jun 7 13:34:13 cl-t030-261cl sshd[30482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-19-82-231.dsl.telesp.net.br
Jun 7 13:34:13 cl-t030-261cl sshd[30482]: pam_succeed_if(sshd:auth): error retrieving information about user <b>alpuser</b>
Jun 7 13:34:15 cl-t030-261cl sshd[30482]: Failed password for invalid user alpuser from 189.19.82.231 port 40907 ssh2
Jun 7 13:34:15 cl-t030-261cl sshd[30483]: Received disconnect from 189.19.82.231: 11: Bye Bye
Jun 7 14:15:04 cl-t030-261cl su: pam_unix(su:session): session closed for user postgres
Jun 7 13:51:36 cl-t030-261cl sshd[32583]: Received disconnect from 189.19.82.231: 11: Bye Bye
Jun 7 13:50:58 cl-t030-261cl sshd[32539]: Received disconnect from 189.19.82.231: 11: Bye Bye
</pre>
<br>
Originalmente solo ocurria durante unas horas, pero en este momento
esta asi casi todo el dia... Si bloqueo la direccion IP, despues de un
rato comienza desde otra.<br>
<br>
Y estas utlimas direcciones parece que viene de ahora de China...<br>
<br>
Segun lei, ese "by-bye" es la firma de una herramienta de escaneo que
al parecer NO es muy buena, pero sigue siendo usada...<br>
<br>
3. snort+snortsam<br>
<br>
Aqui si. no tengo idea que heramientas son estas...<br>
Me pueden dar una breve descripcion?...<br>
<br>
<br>
Javier Delgado<br>
<br>
El 07/06/2010 07:07 p.m., <br>
Gunnar Wolf escribió:<br>
<br>
<blockquote cite="mid:20100608000742.GI16943@gwolf.org" type="cite">
<pre wrap="">Luis Daniel Lucio Quiroz dijo [Sun, May 30, 2010 at 11:45:58AM -0500]:
</pre>
<blockquote type="cite">
<pre wrap="">Tu problema es un clásico DoS, y es fácil evitarlo. No tienes que cambiar
nada. Ahí te va como: Son varias opciones:
1. utiliza mod_country de apache y bloqueas todo rusia :)
2. crea una regla de iptables para establecer un threshold y bloquear las ips
que tengan una tasa sécifica de hits/tiempo
3. utiliza snort+snortsam para detectar el ataque y bloquearlo
personalmente 1 y 3 son las más efectivas.
y siempre esta la 4
4. Contrata mis servicios profesionales :) jiji
</pre>
</blockquote>
<pre wrap="">
¿Y la 4. incluye que desactives el patrón agresivo en tus zombies? ;-)
</pre>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
No virus found in this incoming message.
Checked by AVG - <a class="moz-txt-link-abbreviated" href="http://www.avg.com">www.avg.com</a>
Version: 8.5.437 / Virus Database: 271.1.1/2923 - Release Date: 06/07/10 06:35:00
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Javier Delgado Rosas
______________________
<a class="moz-txt-link-abbreviated" href="mailto:JavierD@paralax.com.mx">JavierD@paralax.com.mx</a>
<a class="moz-txt-link-abbreviated" href="http://www.paralax.com.mx">www.paralax.com.mx</a>
En twitter:
<a class="moz-txt-link-freetext" href="http://twitter.com/paralaxmultimed">http://twitter.com/paralaxmultimed</a></pre>
</body>
</html>
<p></p>
-- <br />
Has recibido este mensaje porque estás suscrito a Grupo "ayuda-linux"<br />
de Grupos de Google.<br />
Si quieres publicar en este grupo, envía un mensaje de correo<br />
electrónico a ayuda-linux@googlegroups.com<br />
Para anular la suscripción a este grupo, envía un mensaje a<br />
ayuda-linux-unsubscribe@googlegroups.com<br />
Para obtener más opciones, visita este grupo en<br />
<a href="http://groups.google.es/group/ayuda-linux?hl=es">http://groups.google.es/group/ayuda-linux?hl=es</a>. o <a href="http://www.compunauta.com/ayuda/">http://www.compunauta.com/ayuda/</a>