Hi,
Ive installed FC5 on my machine.
In the past month, when I was away, some hackers (who seem to come in
from machines in canada, croatia, italy, and aol) ran a dictionary attack on
my machine, and managed to break into an account called "backup".
Im not sure if "backup" was a valid account in the first place -- the logs
show that the hackers failed to login to backup twice, and then successfully
logged in ever after.
Its easy to make out that its a classic dictionary attack -- they've tried
about a hundred userids, and attempted to login several thousand times.
They tried "backup" thrice and managed to get in.
Im particularly concerned that either
a. Backup is not a standard account and they managed to create it
nevertheless
or
b. They managed to login to a standard installation account, which should
really have had /bin/false as shell and should not have been
log-into-able.
Pls. advice. Im trying to ensure this doesnt happen again.
In the meantime, Ive written to the postmaster at aol about the hacker.
Thanks
Bhiksha
--
Fedora-security-list mailing list
Fedora-security-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-security-list
