Re: sshd attack?

2001-08-18 Thread Andres Salomon
ippl is also quite helpful. http://pltplp.net/ippl/. On Wed, Aug 15, 2001 at 09:59:27AM +0200, J?rgen Persson wrote: [...] How can I find out, from where this attack is originating? Must I increase the verbositiy level of sshd to achieve this? sshd might be able to do it. I'm logging

Re: sshd attack?

2001-08-15 Thread Philipp Schulte
On Wed, Aug 15, 2001 at 09:37:51AM +0200, Siegbert Baude wrote: I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected I got the same. Aug 14 11:46:44 nepomuk sshd[12166]:

Re: sshd attack?

2001-08-15 Thread Jörgen Persson
On Wed, Aug 15, 2001 at 09:37:51AM +0200, Siegbert Baude wrote: Hello, I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected What´s this? I do not know. How can I find out,

Re: sshd attack?

2001-08-15 Thread Matthew Sackman
In fact why not just be really cruel: install the dtk (deception toolkit) - find it at all.net - and then watch the hackers think that they've found a vulnerable box and try to exploit it whilst you gather enough information about them to... [fill in as necessary]. Of course all the files that

sshd attack?

2001-08-15 Thread Siegbert Baude
Hello, I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected What´s this? How can I find out, from where this attack is originating? Must I increase the verbositiy level of sshd to achieve

Re: sshd attack?

2001-08-15 Thread Philipp Schulte
On Wed, Aug 15, 2001 at 09:37:51AM +0200, Siegbert Baude wrote: I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected I got the same. Aug 14 11:46:44 nepomuk sshd[12166]: Disconnecting:

Re: sshd attack?

2001-08-15 Thread Jörgen Persson
On Wed, Aug 15, 2001 at 09:37:51AM +0200, Siegbert Baude wrote: Hello, I get about 100 log entries of the following pattern: Aug 14 01:29:01 myserver sshd[27175]: Disconnecting: crc32 compensation attack: network attack detected What´s this? I do not know. How can I find out, from

Re: sshd attack?

2001-08-15 Thread Matthew Sackman
In fact why not just be really cruel: install the dtk (deception toolkit) - find it at all.net - and then watch the hackers think that they've found a vulnerable box and try to exploit it whilst you gather enough information about them to... [fill in as necessary]. Of course all the files that

Re: sshd attack?

2001-08-15 Thread Philipp Schulte
On Wed, Aug 15, 2001 at 08:16:26PM +0100, Matthew Sackman wrote: In fact why not just be really cruel: install the dtk (deception toolkit) - find it at all.net - and then watch the hackers think that they've found a vulnerable box and try to exploit it whilst you gather enough information