🚀 go-pugleaf

In aus.computers.linux Bit Twister <BitTwister@localhost.localdomain> wrote:
: On Mon, 27 May 2002 06:50:40 +0800, Graham Daniell wrote:
:> I have a RH 6.2 Linux server (torvalds) which provides internet
:> connection for my home network of several Win9x PC's and one RH72
:> PC.
:> 
:> For some time I have been getting attacked by this IP number:
:> 
:> May 26 12:04:35 torvalds in.telnetd[915]: refused connect from
:> 195.119.1.180
:> May 26 12:19:35 torvalds in.telnetd[921]: refused connect from
:> 195.119.1.180
:> May 26 18:08:44 torvalds in.telnetd[1069]: refused connect from
:> 195.119.1.180
:> May 26 18:51:07 torvalds in.telnetd[1087]: refused connect from
:> 195.119.1.180
:> 
:> Last night's message log showed this:
:> 
:> May 26 20:49:41 torvalds network: Bringing up route unknown
:> succeeded
:> May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
:> May 26 20:49:49 torvalds network: Bringing up route unknown
:> succeeded
:> May 26 20:49:50 torvalds network: Bringing up route eth0 succeeded
:> May 26 20:55:49 torvalds network: Bringing up route unknown
:> succeeded
:> May 26 20:55:49 torvalds network: Bringing up route eth0 succeeded
:> May 26 20:56:00 torvalds network: Bringing up route unknown
:> succeeded
:> May 26 20:56:00 torvalds network: Bringing up route eth0 succeeded
:> 
:> It looks to me like someone managed to install a route between my
:> internal network and an unknown address (probably 195.119.1.180?)
:> 
:> Should I be worried?  (I already am :-(  )
:> 
:> Should I not use my internal network till I reformat and relaod my
:> RH62 server?

: Telnet and ftp are insecure.

: login id and password is passed as clear text and can
: be snatched with a packet sniffer off both ends of the connection.


: That ip resolves to open.proxy.austnet.org

All reasonably sane advice below this point, however its worth injecting a little
perspecitve.

`open.proxy.austnet.org` is polling your machine to check if you have telnet and
SOCKS proxies open. If you do, it will k-line you from the IRC server you're using
(do you frequent Austnet?) and tell you to fix it.

Its a bit of cruel-to-be-kind from the IRC server admins.

Its all well and good to have logging, but understanding what it is that you log
is somewhat useful too.

HTH,
D.
-- 
" I don't get mad.... I get stabby. "
- William "Fat Tony" Williams.