-=> TCOB1 wrote to All <=-

 TC> Passwords are rarely appreciated until a security breach occurs;

I get a kick out of running lastb and look at the strange names people use
to try to break in my system.

Most of the names are expected, like "root", "ubuntu", "admin", and such.

Some of the names are weird...

===
root     ssh:notty    194.0.234.37     Wed Feb 26 12:16 - 12:16  (00:00)    
bin      ssh:notty    92.255.57.132    Wed Feb 26 12:09 - 12:09  (00:00)    
hcg      ssh:notty    2.57.122.192     Wed Feb 26 12:05 - 12:05  (00:00)    
hcg      ssh:notty    2.57.122.192     Wed Feb 26 12:05 - 12:05  (00:00)    
liumiao  ssh:notty    2.57.122.192     Wed Feb 26 11:57 - 11:57  (00:00)    
liumiao  ssh:notty    2.57.122.192     Wed Feb 26 11:57 - 11:57  (00:00)    
CH       ssh:notty    2.57.122.192     Wed Feb 26 11:49 - 11:49  (00:00)    
CH       ssh:notty    2.57.122.192     Wed Feb 26 11:49 - 11:49  (00:00)    
cs2serve ssh:notty    103.82.93.126    Wed Feb 26 11:46 - 11:46  (00:00)    
cs2serve ssh:notty    103.82.93.126    Wed Feb 26 11:46 - 11:46  (00:00)    
ociispth ssh:notty    103.82.93.126    Wed Feb 26 11:44 - 11:44  (00:00)    
ociispth ssh:notty    103.82.93.126    Wed Feb 26 11:44 - 11:44  (00:00)    
liangshu ssh:notty    2.57.122.192     Wed Feb 26 11:40 - 11:40  (00:00)    
liangshu ssh:notty    2.57.122.192     Wed Feb 26 11:40 - 11:40  (00:00)    
root     ssh:notty    103.82.93.126    Wed Feb 26 11:34 - 11:34  (00:00)    
sun      ssh:notty    2.57.122.192     Wed Feb 26 11:32 - 11:32  (00:00)    
sun      ssh:notty    2.57.122.192     Wed Feb 26 11:32 - 11:32  (00:00)    
root     ssh:notty    103.82.93.126    Wed Feb 26 11:32 - 11:32  (00:00)    
mc       ssh:notty    103.82.93.126    Wed Feb 26 11:25 - 11:25  (00:00)    
mc       ssh:notty    103.82.93.126    Wed Feb 26 11:25 - 11:25  (00:00)    
wyx      ssh:notty    2.57.122.192     Wed Feb 26 11:24 - 11:24  (00:00)    
wyx      ssh:notty    2.57.122.192     Wed Feb 26 11:24 - 11:24  (00:00)    
debian   ssh:notty    92.255.57.132    Wed Feb 26 11:20 - 11:20  (00:00)    
debian   ssh:notty    92.255.57.132    Wed Feb 26 11:20 - 11:20  (00:00)    
liuwei   ssh:notty    2.57.122.192     Wed Feb 26 11:16 - 11:16  (00:00)    
liuwei   ssh:notty    2.57.122.192     Wed Feb 26 11:16 - 11:16  (00:00)    
masifan  ssh:notty    2.57.122.192     Wed Feb 26 11:08 - 11:08  (00:00)    
===

Looks like someone in Romania was bored today.

The best part is when fail2ban kicks in.  I have a very customized install
of f2b that has a "subnet-recidive" filter in it that blocks problematic
subnets for 26 weeks at a time.

I also have a firewall set up on the BBS box and pfSense as my edge firewall
device.

While there's no perfect solution, no one has ever been successful in
breaking into my system yet.

I should change some passwords though...been using them for a long time.

-- Sean

... The trouble with experience is that it sometimes teaches you too late.
--- MultiMail/Linux
 * Origin: Outpost BBS * Johnson City, TN (618:618/1)