WARNING!!!! Possible Attack

[Lidinho]

Hi All,

Lately I have been getting these warnings on my server logs:

...
 WARNING!!!!  Possible Attack:
    Attempt from 12-219-159-11.client.mchsi.com [12.219.159.11] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from 62.128.48.118.static.012.net.il [62.128.48.118] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from 80.178.18.217.adsl.012.net.il [80.178.18.217] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from 87.69.46.205.cable.012.net.il [87.69.46.205] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from bzq-88-153-35-53.red.bezeqint.net [88.153.35.53] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from cbl217-132-248-104.bb.netvision.net.il [217.132.248.104] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from corellia.odessa.tv [194.140.228.10] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from ds81-30-195-107.ufanet.ru [81.30.195.107] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from host81-157-77-64.range81-157.btcentralplus.com [81.157.77.64] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from host81-158-214-22.range81-158.btcentralplus.com [81.158.214.22] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from pool-72-93-1-73.bstnma.east.verizon.net [72.93.1.73] with:
       command=HELO/EHLO, count=3: 1 Time(s)
    Attempt from static-ip-217-87-56-61.rev.dyxnet.com [61.56.87.217] with:
       command=HELO/EHLO, count=3: 1 Time(s)
 	Total:  12 Time(s)
...

I would highly appreciate it if someone could assist me in troubleshooting these messages.

I am running Fedora Core 4 on this server.

Thanks,
Lidinho

 

[KenCunningham]

Hi Lidinho. This page:

http://www.linuxforums.org/forum/linux-security/76614-logwatch-warning-possible-attack.html

recommends using arin whois to discover who the IPs are registered by. Presumably you can then report the infingements. Good luck.

I don't mind people who aren't what they seem. I just wish they'd make their mind up.

 

[Lidinho]

Thanks Ken,

Will have a look

Thanks,
Lidinho

 

[Lidinho]

Hi All,

I have been monitoring the logs, and have been sending abuse reports to the relevant ISPs.

Can someone point in the right direction with regards to using SELinux efficiently?

Thanks,
Lidinho