-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
I have also noticed a large number of attempts from machines in ThePlanet.coms address range. Since we are a school, I eventually just blocked every address of theirs at our firewall to prevent anything from getting through. Be careful though because I have had to unblock about 10 IP addresses that are in their range that we needed access to. I have contacted the company by e-mail and phone and have never received a response.
Yes, I understand they are a large datacenter that lets is users use their IP addresses, but since I had several attempts and nobody every contacted me (4 separate e-mails) I blocked them.
I do recommend contacting the company if you continue having problems. If you have questions about how to contact them, let me know and I can try to help you.
Nathaniel Hall, GSEC Intrusion Detection and Firewall Technician Ozarks Technical Community College -- Office of Computer Networking
halln@xxxxxxx 417-447-7535 GPG Public Key ID: 0xAC187312
Ryan Golhar wrote: | Hi all, | | I notice in our logs that we get a large amount of failed attempts to | log in. Short of blocking these domains using iptables, I was wondering | if there is a way to display the IP address of the user logging in, in a | message so they know we have their IP address? | | sshd: | Invalid Users: | Unknown Account: 602 Time(s) | Authentication Failures: | xfs (138.67-18-71.reverse.theplanet.com ): 1 Time(s) | root (nitrogen.umdnj.edu ): 1 Time(s) | root (138.67-18-71.reverse.theplanet.com ): 1 Time(s) | unknown (138.67-18-71.reverse.theplanet.com ): 595 Time(s) | unknown (218.153.147.92 ): 6 Time(s) | daemon (138.67-18-71.reverse.theplanet.com ): 1 Time(s) | root (218.153.147.92 ): 3 Time(s) | rpc (138.67-18-71.reverse.theplanet.com ): 1 Time(s) | unknown (10.136.16.244 ): 1 Time(s) | smmsp (138.67-18-71.reverse.theplanet.com ): 1 Time(s) | | | -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (MingW32)
iD8DBQFCb9Lpc+QrUawYcxIRAmMoAJ4uel28YyJeZ2exO2O+y6lxOjrJQgCeLmuG 8xKSkQNsvGmJCihJibwFr0s= =feEc -----END PGP SIGNATURE-----
-- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list
