Very Computer

by **Breh** » Sun, 26 May 2002 17:48:27

Hello,

OBSD 2.8

Curious what if anything I should do about the following problem.

For some reason a person/machine keeps attempting to login to my ip
address via Telnet. Of course I have it blocked and log any attempt
to login via port 23.

It is flooding my terminal with the log messages. He/she has tried a
few hundred times at least over the past few hours.

I am on DHCP, but keep getting assigned the same IP address on reboot.
(Strange, I usually like keeping the same address).

Is there anything in particular I should be aware of? Is there any
course of action or approach you would take?

Thanks for your help,

Brehmie

by **Henrik St?h** » Sun, 26 May 2002 19:08:55

Find out who the attacker's ISP is using whois, and send an email
to their abuse department. Not much else to do, except maybe stop
logging these messages.

Have you considered automatic issue reporting via www.mynetwatchman.com?

/Henrik

> Hello,

> OBSD 2.8

> Curious what if anything I should do about the following problem.

> For some reason a person/machine keeps attempting to login to my ip
> address via Telnet. Of course I have it blocked and log any attempt
> to login via port 23.

> It is flooding my terminal with the log messages. He/she has tried a
> few hundred times at least over the past few hours.

> I am on DHCP, but keep getting assigned the same IP address on reboot.
> (Strange, I usually like keeping the same address).

> Is there anything in particular I should be aware of? Is there any
> course of action or approach you would take?

> Thanks for your help,

> Brehmie

by **erik** » Sun, 26 May 2002 21:16:01

> Hello,

> OBSD 2.8

> Curious what if anything I should do about the following problem.

> For some reason a person/machine keeps attempting to login to my ip
> address via Telnet. Of course I have it blocked and log any attempt
> to login via port 23.

> It is flooding my terminal with the log messages. He/she has tried a
> few hundred times at least over the past few hours.

> I am on DHCP, but keep getting assigned the same IP address on reboot.
> (Strange, I usually like keeping the same address).

> Is there anything in particular I should be aware of? Is there any
> course of action or approach you would take?

I would block him without logging. Probably only the telnet connects to see
what more will be happening. Blocking is easy with ipf.

HTH,

EJ
--
For OpenBSD pf en nat rule examples: http://www.vanwesten.net

by **Jan-Uwe Fin** » Sun, 26 May 2002 19:27:27

Quote:> Is there anything in particular I should be aware of? Is there any
> course of action or approach you would take?

If you have a telnet server running, you should disable it, otherwise
there's nothing to be afraid of.

by **Breh** » Wed, 29 May 2002 10:54:21

Thank you for your comments / suggestions. The 'hammering' has
finally stopped.

Very Computer

a person is hammering my port 23

a person is hammering my port 23

a person is hammering my port 23

a person is hammering my port 23

a person is hammering my port 23

a person is hammering my port 23