Newsgroup: it.comp.os.linux.sys
Titolo: era server violato

allora vi aggiorno sulla situazione oggi ho riavviato il server che si č 
inchiodato ieri ..
Da una prima analisi sembrerebbe la combinazione di due cause la prima hw 
( devo stabilire se ram o dischi) e la seconda piů che una causa una vera 
preoccupazione.
Il server in questione fa da samba server , dhcp e gw per internet e tengo 
aperte sul firewall solo ssh e webmin. Ora la questione č che essendo un 
server di laboratorio, in quanto il server web, posta ecc sono in altra 
irraggiungibile rete dalla lan ho configurato suse firewall per 
proteggermi... so che dovrei farlo a mano lo script ma non ho tempo.
nei log trovo in messages
Jun 10 15:36:49 linux sshd[26111]: Invalid user narisue from 221.112.143.19
Jun 10 15:36:52 linux sshd[26113]: Invalid user narisuke from 221.112.143.19
Jun 10 15:36:55 linux sshd[26115]: Invalid user naritada from 221.112.143.19
Jun 10 15:36:58 linux sshd[26117]: Invalid user naritane from 221.112.143.19
Jun 10 15:37:01 linux sshd[26119]: Invalid user naritoki from 221.112.143.19
Jun 10 15:37:04 linux sshd[26121]: Invalid user naritsuna from 
221.112.143.19
Jun 10 15:37:07 linux sshd[26123]: Invalid user naritsune from 
221.112.143.19
Jun 10 15:37:08 linux kernel: martian source 192.168.1.255 from 
192.168.1.233, on dev eth2
Jun 10 15:37:08 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:ed:09:08:00
Jun 10 15:37:08 linux kernel: martian source 192.168.1.255 from 
192.168.1.233, on dev eth2
Jun 10 15:37:08 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:ed:09:08:00
Jun 10 15:37:10 linux sshd[26125]: Invalid user naritsura from 
221.112.143.19
Jun 10 15:37:13 linux sshd[26127]: Invalid user nariuji from 221.112.143.19
Jun 10 15:37:16 linux sshd[26129]: Invalid user nariyoshi from 
221.112.143.19
Jun 10 15:37:19 linux sshd[26131]: Invalid user narozniak from 
221.112.143.19
Jun 10 15:37:22 linux sshd[26133]: Invalid user nartangela from 
221.112.143.19
Jun 10 15:37:25 linux sshd[26135]: Invalid user nasa from 221.112.143.19
Jun 10 15:37:28 linux sshd[26137]: Invalid user naser from 221.112.143.19
Jun 10 15:37:31 linux sshd[26139]: Invalid user nashawn from 221.112.143.19
Jun 10 15:37:34 linux sshd[26141]: Invalid user nash from 221.112.143.19
Jun 10 15:37:38 linux sshd[26143]: Invalid user nasiha from 221.112.143.19
Jun 10 15:37:41 linux sshd[26145]: Invalid user nasila from 221.112.143.19
Jun 10 15:37:44 linux sshd[26147]: Invalid user nasima from 221.112.143.19
Jun 10 15:37:47 linux sshd[26149]: Invalid user nasira from 221.112.143.19
Jun 10 15:37:50 linux sshd[26151]: Invalid user nasir from 221.112.143.19
Jun 10 15:37:53 linux sshd[26153]: Invalid user nasreen from 221.112.143.19
Jun 10 15:37:56 linux sshd[26155]: Invalid user nassar from 221.112.143.19
Jun 10 15:37:59 linux sshd[26157]: Invalid user nasser from 221.112.143.19
Jun 10 15:38:02 linux sshd[26159]: Invalid user nassim from 221.112.143.19
Jun 10 15:38:05 linux sshd[26161]: Invalid user nassir from 221.112.143.19
Jun 10 15:38:08 linux sshd[26163]: Invalid user nassrin from 221.112.143.19
Jun 10 15:41:45 linux kernel: martian source 192.168.1.255 from 
192.168.1.98, on dev eth2
Jun 10 15:41:45 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:00:48:ca:b1:36:08:00
Jun 10 15:48:55 linux kernel: martian source 10.255.255.255 from 10.0.0.1, 
on dev eth0
Jun 10 15:48:55 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:e5:39:08:00
Jun 10 15:48:55 linux kernel: martian source 10.255.255.255 from 10.0.0.1, 
on dev eth0
Jun 10 15:48:55 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:e5:39:08:00
Jun 10 15:49:15 linux kernel: martian source 192.168.1.255 from 
192.168.1.233, on dev eth2
Jun 10 15:49:15 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:ed:09:08:00
Jun 10 15:49:15 linux kernel: martian source 192.168.1.255 from 
192.168.1.233, on dev eth2
Jun 10 15:49:15 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:ed:09:08:00
Jun 10 15:54:07 linux kernel: martian source 192.168.1.255 from 
192.168.1.98, on dev eth2
Jun 10 15:54:07 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:00:48:ca:b1:36:08:00
Jun 10 16:00:01 linux /usr/sbin/cron[26205]: (root) CMD 
(/etc/webmin/bandwidth/
rotate.pl
)
Jun 10 16:00:01 linux syslog-ng[5257]: SIGHUP received, restarting syslog-ng
Jun 10 16:00:02 linux syslog-ng[5257]: new configuration initialized
Jun 10 16:00:57 linux syslog-ng[5257]: Changing permissions on special file 
/dev/xconsole
Jun 10 16:00:57 linux syslog-ng[5257]: Changing permissions on special file 
/dev/tty10
Jun 10 16:00:57 linux kernel: martian source 10.255.255.255 from 10.0.0.1, 
on dev eth0
Jun 10 16:00:57 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:e5:39:08:00
Jun 10 16:00:57 linux kernel: martian source 10.255.255.255 from 10.0.0.1, 
on dev eth0
Jun 10 16:00:57 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:e5:39:08:00
Jun 10 16:01:17 linux kernel: martian source 192.168.1.255 from 
192.168.1.233, on dev eth2
Jun 10 16:01:17 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:ed:09:08:00
Jun 10 16:01:17 linux kernel: martian source 192.168.1.255 from 
192.168.1.233, on dev eth2
Jun 10 16:01:17 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:15:f2:99:ed:09:08:00
Jun 10 16:06:30 linux kernel: martian source 192.168.1.255 from 
192.168.1.98, on dev eth2
Jun 10 16:06:30 linux kernel: ll header: 
ff:ff:ff:ff:ff:ff:00:00:48:ca:b1:36:08:00
Jun 12 12:25:05 linux syslog-ng[4998]: syslog-ng version 1.6.8 starting
Jun 12 12:25:06 linux syslog-ng[4998]: Changing permissions on special file 
/dev/xconsole
Jun 12 12:25:06 linux syslog-ng[4998]: Changing permissions on special file 
/dev/tty10
Jun 12 12:25:06 linux ifup-route: Warning: Could not set up default route 
via interface
Jun 12 12:25:06 linux ifup-route: Command ip route replace to default via 
81.73.60.78 returned:
Jun 12 12:25:06 linux ifup-route: . RTNETLINK answers: Network is 
unreachable
Jun 12 12:25:06 linux ifup-route: Configuration line: default 
81.73.60.78 - -
Jun 12 12:25:06 linux ifup-route: This needs NOT to be AN ERROR if you set 
up multiple interfaces.
Jun 12 12:25:06 linux ifup-route: See man 5 routes how to avoid this 
warning.
Jun 12 12:25:06 linux mDNSResponder (Engineering Build) (Sep  9 2005 
17:22:16) [5411]: starting
Jun 12 12:25:10 linux kernel: klogd 1.4.1, log source = /proc/kmsg started.
Jun 12 12:25:10 linux kernel: parport0: PC-style at 0x378 [PCSPP,TRISTATE]
Jun 12 12:25:10 linux kernel: lp0: using parport0 (polling).
Jun 12 12:25:10 linux kernel: pci_hotplug: PCI Hot Plug PCI Core version: 
0.5
Jun 12 12:25:10 linux kernel:     ACPI-1174: *** Error: Method execution 
failed [\_SB_.LSTA] (Node ffff810001bc0c40), AE_TYPE
Jun 12 12:25:10 linux kernel:     ACPI-1174: *** Error: Method execution 
failed [\_SB_.LATA._STA] (Node ffff810001bc2100), AE_TYPE
Jun 12 12:25:10 linux kernel:     ACPI-0171: *** Error: Method execution 
failed [\_SB_.LATA._STA] (Node ffff810001bc2100), AE_TYPE
Jun 12 12:25:10 linux kernel: shpchp: Standard Hot Plug PCI Controller 
Driver version: 0.4
Jun 12 12:25:10 linux kernel: i2c_adapter i2c-0: nForce2 SMBus adapter at 
0x600
Jun 12 12:25:10 linux kernel: i2c_adapter i2c-1: nForce2 SMBus adapter at 
0x700
Jun 12 12:25:10 linux kernel: usbcore: registered new driver usbfs
Jun 12 12:25:10 linux kernel: usbcore: registered new driver hub
Jun 12 12:25:10 linux kernel: ohci_hcd: 2005 April 22 USB 1.1 'Open' Host 
Controller (OHCI) Driver (PCI)
Jun 12 12:25:10 linux kernel:     ACPI-0212: *** Warning: Device is not 
power manageable
o in warn
Jun 12 12:25:26 linux kernel: hdc: media error (bad sector): status=0x51 { 
DriveReady SeekComplete Error }
Jun 12 12:25:26 linux kernel: hdc: media error (bad sector): error=0x34 { 
AbortedCommand LastFailedSense=0x03 }
Jun 12 12:25:26 linux kernel: ide: failed opcode was: unknown
Jun 12 12:25:26 linux kernel: end_request: I/O error, dev hdc, sector 68
Jun 12 12:25:26 linux kernel: Buffer I/O error on device hdc, logical block 
17
quindi mi sembrerebbe disco ?
Come potete vedere ho avuto parecchi tentativi di accesso ssh !
grazie per l'aiuto

 Come potete vedere ho avuto parecchi tentativi di accesso ssh !
A volte basta non utilizzare la porta di default. Poi magari disabilita
le password ed utilizza l'autenticazione tramite chiavi.
Ciao.
-- 
*** Linux user # 198661 --- ICQ 33500725 ***
***  Home  
http://web.tiscali.it/kailed
  ***
       ***  Powered by SuSeLinux  ***

 ha scritto nel messaggio 
news:un81m3-...@kailed.fyrfos.net...
