Ja, so sieht es aus – der neue Server ist noch keine 24h online, schon versucht so ein kleines chinesisches Skriptkiddie hier einzubrechen.
Finger weg – ich weiß wer Du bist!
Hier ein Auszug aus dem Logfile:
2010-06-01 13:53:02.646887500 Failed password for root from 124.193.148.139 port 46769 ssh2 2010-06-01 13:53:03.021760500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:08.031025500 Failed password for root from 124.193.148.139 port 47209 ssh2 2010-06-01 13:53:08.417109500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:13.422098500 Failed password for root from 124.193.148.139 port 47566 ssh2 2010-06-01 13:53:13.794003500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:18.804498500 Failed password for root from 124.193.148.139 port 47925 ssh2 2010-06-01 13:53:19.161671500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:24.220493500 Failed password for root from 124.193.148.139 port 48281 ssh2 2010-06-01 13:53:24.560383500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:29.664235500 Failed password for root from 124.193.148.139 port 48642 ssh2 2010-06-01 13:53:30.043306500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:35.024576500 Failed password for root from 124.193.148.139 port 48997 ssh2 2010-06-01 13:53:35.400385500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:40.427344500 Failed password for root from 124.193.148.139 port 49359 ssh2 2010-06-01 13:53:40.783682500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:45.876441500 Failed password for root from 124.193.148.139 port 49702 ssh2 2010-06-01 13:53:46.238557500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:51.247689500 Failed password for root from 124.193.148.139 port 50029 ssh2 2010-06-01 13:53:51.627630500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:53:56.650081500 Failed password for root from 124.193.148.139 port 50388 ssh2 2010-06-01 13:53:57.031853500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:54:02.078402500 Failed password for root from 124.193.148.139 port 50740 ssh2 2010-06-01 13:54:02.463343500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:54:07.513184500 Failed password for root from 124.193.148.139 port 51102 ssh2 2010-06-01 13:54:07.893927500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:54:10.581227500 Invalid user oracle from 124.193.148.139 2010-06-01 13:54:10.581231500 input_userauth_request: invalid user oracle 2010-06-01 13:54:12.932924500 Failed password for invalid user oracle from 124.193.148.139 port 51412 ssh2 2010-06-01 13:54:13.298589500 Received disconnect from 124.193.148.139: 11: Bye Bye 2010-06-01 13:54:15.959827500 Invalid user test from 124.193.148.139 2010-06-01 13:54:15.961403500 input_userauth_request: invalid user test 2010-06-01 13:54:18.312062500 Failed password for invalid user test from 124.193.148.139 port 51688 ssh2 2010-06-01 13:54:18.682113500 Received disconnect from 124.193.148.139: 11: Bye Bye
Hier gibts keinen user root und auch keinen der oracle heisst.
Und nun schaun wir mal zu wem die IP-Adresse gehört:
inetnum: 124.192.0.0 - 124.193.255.255 netname: DXTNET descr: Beijing Teletron Telecom Engineering Co., Ltd. descr: Jian Guo Road, Chaoyang District, Beijing, PR.China country: CN admin-c: SD256-AP tech-c: DL767-AP status: ALLOCATED PORTABLE mnt-by: MAINT-CNNIC-AP mnt-lower: MAINT-CNNIC-AP mnt-routes: MAINT-CNCGROUP-RR changed: ipas@cnnic.cn 20080911 source: APNIC
person: Shoulan Du nic-hdl: SD256-AP e-mail: Betsy.du@bj.datadragon.net address: No. 20, Fuxing Road, Beijing phone: +86-010-65661868-236 fax-no: +86-010-65660882 country: CN changed: ipas@cnnic.cn 20060508 mnt-by: MAINT-CNNIC-AP source: APNIC
person: Donghai Liu nic-hdl: DL767-AP e-mail: liudonghai@btte.net address: No. 20, Fuxing Road, Beijing phone: +86-010-65661868-230 fax-no: +86-010-65660882 country: CN changed: ipas@cnnic.cn 20090402 mnt-by: MAINT-CNNIC-AP source: APNIC
Also doch die Chinesen. Bleibts mir vom Hals – hier gibts nix zu holen. Nicht für euch!