First Attack on my MT, help !!

Lukasz · Fri May 19, 2006 4:26 pm

il log's i see a message like this :

(date) system error critical login failure for user (*) from 21.22.13.13 via ssh

(*) it's name of users, this users changes ....

What make to stop the attack ?

Lukasz

Fri May 19, 2006 4:35 pm

1. To change SSH used port at 'ip service'.
2. To allow SSH access only from specific subnet 'ip service set ssh address='.
3. To create firewall rules, that will allow access only for specified 'src-addresses'.

fatonk · Fri May 19, 2006 4:36 pm

this is very often seen on the MT with Public IP addresses, you can tighten your security with proper configuration of the firewall, you can change the SSH port, disable telnet, aloww only certain IP's to connect etc etc.

Regards.

Faton

Lukasz · Fri May 19, 2006 4:44 pm

ok, it's work

I make off some , services and this help..

thank's