[arm-allstar] Does this look like someone is brute force attacking my node?

[stanley stanukinos]

It maybe time to use the firewall rules and start dropping all IP addresses from certain blocks. You can set it up where if the source address is in your drop list it just goes away and the actor does not get a response back to know if you are there. 

Stan

Sent from my iPhone

> On Feb 25, 2020, at 11:07 AM, Dave Robinson via ARM-allstar <arm-allstar at hamvoip.org> wrote:
> 
> Just copy one of the IP addresses from the log and paste it into the search box on https://www.ip-tracker.org/
> 
> The location is usually the ISP unless it's a private or leased line.
> 
> Interesting but not much help.
> 
> 73 Dave M0LMN
> 
> -----Original Message-----
> From: ARM-allstar <arm-allstar-bounces at hamvoip.org> On Behalf Of "Gervais Fillion via ARM-allstar"
> Sent: 25 February 2020 11:55
> To: ARM Allstar <arm-allstar at hamvoip.org>
> Cc: Gervais Fillion <ve2ckn2 at hotmail.fr>
> Subject: Re: [arm-allstar] Does this look like someone is brute force attacking my node?
> 
> Anyone as "trace" from where those attacks where coming from???
> just curious!!
> 
> Gervais
> 
> 
> ________________________________
> De : ARM-allstar <arm-allstar-bounces at hamvoip.org> de la part de "Orrin Winton via ARM-allstar" <arm-allstar at hamvoip.org> Envoyé : 25 février 2020 02:52 À : ARM Allstar <arm-allstar at hamvoip.org> Cc : Orrin Winton <orrin.winton at gmail.com>; Matt Rhoades <ki7uef at gmail.com> Objet : Re: [arm-allstar] Does this look like someone is brute force attacking my node?
> 
> Thanks for the https://paste.ofcode.org/    site. That is a useful tool.
> 
> de wn1z
> 
> 
>> On Mon, Feb 24, 2020 at 10:59 PM "Matt Rhoades via ARM-allstar" < arm-allstar at hamvoip.org> wrote:
>> 
>> I'm far from a network security guy.... but is this hundreds of 
>> attempts to ssh to my node with failed user/auth?
>> 
>> https://paste.ofcode.org/GFCYh8eZbVSwWExjiNWmZ
>> _______________________________________________
>> 
>> ARM-allstar mailing list
>> ARM-allstar at hamvoip.org
>> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar
>> 
>> Visit the BBB and RPi2/3/4 web page - http://hamvoip.org
>> 
> _______________________________________________
> 
> ARM-allstar mailing list
> ARM-allstar at hamvoip.org
> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar
> 
> Visit the BBB and RPi2/3/4 web page - http://hamvoip.org _______________________________________________
> 
> ARM-allstar mailing list
> ARM-allstar at hamvoip.org
> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar
> 
> Visit the BBB and RPi2/3/4 web page - http://hamvoip.org
> _______________________________________________
> 
> ARM-allstar mailing list
> ARM-allstar at hamvoip.org
> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar
> 
> Visit the BBB and RPi2/3/4 web page - http://hamvoip.org