is someone trying to hack my site? see this logwatch entry

H

htmlguy212

Verified User
Joined
Dec 30, 2006
Messages
8
I just got this from logwatch this morning:


sshd:
Authentication Failures:
unknown (sd-1759.dedibox.fr): 91 Time(s)
adm (sd-1759.dedibox.fr): 4 Time(s)
unknown (xxx.dsl-w.verizon.net): 1 Time(s)
Invalid Users:
Unknown Account: 92 Time(s)


Received disconnect:
11: Bye Bye
88.191.18.111 : 262 Time(s)

SFTP subsystem requests: 4 Time(s)

**Unmatched Entries**
input_userauth_request: invalid user test
Failed password for invalid user test from 88.191.18.111 port 54598 ssh2
input_userauth_request: invalid user test
input_userauth_request: invalid user test
input_userauth_request: invalid user test
Failed password for invalid user test from 88.191.18.111 port 38889 ssh2
Failed password for invalid user test from 88.191.18.111 port 49317 ssh2
---------------truncated---------------------

how should I handle this?
 
Last edited:
I suggest you to find another dedicated server provider.

They are having network problems for a month and 2 weeks now and they are not planning to fix it.

-------

dedibox.fr or bestofdata is the worst in dedicated servers providers.. YES They are cheap, but the worst services on the net. I had 3 servers there and i had to cancel all of them after this problem.. today I still have a server with them which expires in 2 or 3 days which im not planning to renew for this same reason. :)
 
thanks, I changed the sshd to not listen on 22 and took off allow root login. Also the .fr host is not mine, it was the domain of the guy trying passwords.

the server has just been up for less than a week and to get this type of attention is making me paranoid for the better. Next step look into secure web access to direct admin (https)

thanks ppl
 
You must log in or register to reply here.
Back
Top