Mac OS X, des choses bizarres dans mon system.log
Le
jperrocheau
Bonjour,
Dans mon system.log (Mac OS X 10.3.5) ce jour je trouve:
Aug 23 18:54:31 xxxx xinetd[318]: START: ssh pid00 from 2.195.11.66
Aug 23 18:54:36 xxxx sshd[1600]: Illegal user test from 202.195.11.66
Aug 23 18:54:37 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:37 xxxx xinetd[318]: START: ssh pid02 from 2.195.11.66
Aug 23 18:54:41 xxxx sshd[1602]: Illegal user guest from 202.195.11.66
Aug 23 18:54:42 Jacques-s-iMac xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:42 xxxx xinetd[318]: START: ssh pid04 from 2.195.11.66
Aug 23 18:54:45 xxxx sshd[1604]: Illegal user admin from 202.195.11.66
Aug 23 18:54:46 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:46 xxxx xinetd[318]: START: ssh pid06 from 2.195.11.66
Aug 23 18:54:50 xxxx sshd[1606]: Illegal user admin from 202.195.11.66
Aug 23 18:54:51 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:51 xxxx xinetd[318]: START: ssh pid08 from 2.195.11.66
Aug 23 18:54:55 xxxx sshd[1608]: Illegal user user from 202.195.11.66
Aug 23 18:54:56 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:56 xxxx xinetd[318]: START: ssh pid10 from 2.195.11.66
Aug 23 18:55:00 xxxx sshd[1610]: Failed password for root from
202.195.11.66 port 45266 ssh2
Aug 23 18:55:01 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:55:01 xxxx xinetd[318]: START: ssh pid12 from 2.195.11.66
Aug 23 18:55:05 xxxx sshd[1612]: Failed password for root from
202.195.11.66 port 45372 ssh2
Aug 23 18:55:06 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:55:06 xxxx xinetd[318]: START: ssh pid14 from 2.195.11.66
Aug 23 18:55:10 xxxx sshd[1614]: Failed password for root from
202.195.11.66 port 45479 ssh2
Est-ce que les spécialistes peuvent me confirmer que c'est un petit
chinois qui se livre au jeu d'essayer de rentrer chez moi sans y
réussir ?
--
Jacques PERROCHEAU
______________________________________________________________
e-mail: mailto:jperrocheau@mac.com
Dans mon system.log (Mac OS X 10.3.5) ce jour je trouve:
Aug 23 18:54:31 xxxx xinetd[318]: START: ssh pid00 from 2.195.11.66
Aug 23 18:54:36 xxxx sshd[1600]: Illegal user test from 202.195.11.66
Aug 23 18:54:37 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:37 xxxx xinetd[318]: START: ssh pid02 from 2.195.11.66
Aug 23 18:54:41 xxxx sshd[1602]: Illegal user guest from 202.195.11.66
Aug 23 18:54:42 Jacques-s-iMac xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:42 xxxx xinetd[318]: START: ssh pid04 from 2.195.11.66
Aug 23 18:54:45 xxxx sshd[1604]: Illegal user admin from 202.195.11.66
Aug 23 18:54:46 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:46 xxxx xinetd[318]: START: ssh pid06 from 2.195.11.66
Aug 23 18:54:50 xxxx sshd[1606]: Illegal user admin from 202.195.11.66
Aug 23 18:54:51 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:51 xxxx xinetd[318]: START: ssh pid08 from 2.195.11.66
Aug 23 18:54:55 xxxx sshd[1608]: Illegal user user from 202.195.11.66
Aug 23 18:54:56 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:54:56 xxxx xinetd[318]: START: ssh pid10 from 2.195.11.66
Aug 23 18:55:00 xxxx sshd[1610]: Failed password for root from
202.195.11.66 port 45266 ssh2
Aug 23 18:55:01 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:55:01 xxxx xinetd[318]: START: ssh pid12 from 2.195.11.66
Aug 23 18:55:05 xxxx sshd[1612]: Failed password for root from
202.195.11.66 port 45372 ssh2
Aug 23 18:55:06 xxxx xinetd[318]: service ssh, IPV6_ADDRFORM
setsockopt() failed: Protocol not available (errno = 42)
Aug 23 18:55:06 xxxx xinetd[318]: START: ssh pid14 from 2.195.11.66
Aug 23 18:55:10 xxxx sshd[1614]: Failed password for root from
202.195.11.66 port 45479 ssh2
Est-ce que les spécialistes peuvent me confirmer que c'est un petit
chinois qui se livre au jeu d'essayer de rentrer chez moi sans y
réussir ?
--
Jacques PERROCHEAU
______________________________________________________________
e-mail: mailto:jperrocheau@mac.com
Poser une question
Un chinois, je ne sais pas, mais quelqu'un en effet à l'adresse IP
202.195.11.66 essaye de se connecter sur ta machine.
Patrick
--
Patrick Stadelmann
Il n'est peut-être pas chinois en tous cas il "manipule" une machine
ici:
% [whois.apnic.net node-1]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 202.195.0.0 - 202.195.15.255
netname: NJHRI-CN
descr: ~{DO>)K.@{?FQ'QP>?T:~}
descr: Nanjing Hydraulic Research Institute
descr: Nanjing, Jiangsu 210029, China
[snip]
--
Jacques PERROCHEAU
______________________________________________________________
e-mail: mailto:
dans ce cas, un bon coup d'Ipfw et paf, les zombies cinois sont dans un
trou :
ipfw add deny tcp from 202.195.0.0/20 to any
Le netmask (/20) est là pour limiter la restriction aux IP de l'ISP
fournisseurs de zombies made in China, et sans doute a OS conçu à
Seatle.
--
http://www.neuneu.org Neu^2 de partout, Neu2 4 ever
C'est Apple qui essaie de remettre a jour la Kbase du robot :-))
--
Claude Demeester
:-))
--
Jacques PERROCHEAU
______________________________________________________________
e-mail: mailto: