Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Was I the target of a successful attack?

    General pfSense Questions
    6
    25
    2325
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jsnicaise last edited by

      I have a cluster of two PFsense node in CARP (pf01 and pf02). Both are 64 bits versions, under VMware vSphere. Both nodes have two vmxnet3 NICs with various vlan interfaces. I've installed the vmxnet3 following the steps provided in the pfsense docs.

      Today, the WAN vlan got knocked out of production. It stopped forwarding traffic. The CARP failover status showed pf01 and pf02 WAN VIP as master (others showed the correct master/backup states), but pf01 WAN did not forward traffic.

      Through a bad NAT configuration, ssh was exposed to the internet.

      I wondering a few things:

      1. could vmxnet3 be that unstable?
      2. Where should I look for more clues as to what happened?
      3. could someone, through an SSH exploit, kill traffic flowing through the WAN?

      I'm seeting that a lot, is it worry some?

      Jan  4 01:22:00 pf01 kernel: VMware memory control driver unloaded
      Jan  4 01:22:00 pf01 kernel: VMware memory control driver initialized

      But the most interresting part, here's the system log for the more or less 15 minutes just before the WAN crapped out:

      Jan  4 00:38:54 pf01 sshd[5193]: Failed password for admin from 87.106.251.42 port 51447 ssh2
      Jan  4 00:38:55 pf01 sshd[7634]: Failed password for admin from 87.106.251.42 port 51628 ssh2
      Jan  4 00:38:58 pf01 check_reload_status: Syncing firewall
      Jan  4 00:38:59 pf01 sshd[7811]: Invalid user debug from 87.106.251.42
      Jan  4 00:38:59 pf01 sshd[7811]: Failed password for invalid user debug from 87.106.251.42 port 52592 ssh2
      Jan  4 00:39:00 pf01 php: rc.filter_synchronize: Beginning XMLRPC sync to https://172.16.204.252:443.
      Jan  4 00:39:01 pf01 php: rc.filter_synchronize: XMLRPC sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:39:03 pf01 php: rc.filter_synchronize: Filter sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:39:03 pf01 sshd[8099]: Invalid user ftp from 87.106.251.42
      Jan  4 00:39:03 pf01 sshd[8099]: Failed password for invalid user ftp from 87.106.251.42 port 53541 ssh2
      Jan  4 00:39:05 pf01 sshd[8517]: Invalid user info from 87.106.251.42
      Jan  4 00:39:05 pf01 sshd[8517]: Failed password for invalid user info from 87.106.251.42 port 53954 ssh2
      Jan  4 00:39:06 pf01 sshd[9120]: Invalid user karaf from 87.106.251.42
      Jan  4 00:39:06 pf01 sshd[9120]: Failed password for invalid user karaf from 87.106.251.42 port 54230 ssh2
      Jan  4 00:39:07 pf01 sshd[9471]: Invalid user log from 87.106.251.42
      Jan  4 00:39:07 pf01 sshd[9471]: Failed password for invalid user log from 87.106.251.42 port 54406 ssh2
      Jan  4 00:39:08 pf01 sshd[9641]: Invalid user marketing from 87.106.251.42
      Jan  4 00:39:08 pf01 sshd[9641]: Failed password for invalid user marketing from 87.106.251.42 port 54618 ssh2
      Jan  4 00:39:09 pf01 sshd[10247]: Invalid user mike from 87.106.251.42
      Jan  4 00:39:09 pf01 sshlockout[37765]: Locking out 87.106.251.42 after 15 invalid attempts
      Jan  4 00:39:09 pf01 sshd[10247]: Failed password for invalid user mike from 87.106.251.42 port 54834 ssh2
      Jan  4 00:39:09 pf01 sshlockout[37765]: Locking out 87.106.251.42 after 15 invalid attempts
      Jan  4 00:39:37 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:39:37 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:39:40 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:39:40 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:39:50 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:39:50 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:39:54 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:39:54 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:39:57 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:39:57 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:40:08 pf01 check_reload_status: Syncing firewall
      Jan  4 00:40:08 pf01 check_reload_status: Reloading filter
      Jan  4 00:40:11 pf01 php: rc.filter_synchronize: Beginning XMLRPC sync to https://172.16.204.252:443.
      Jan  4 00:40:12 pf01 php: rc.filter_synchronize: XMLRPC sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:40:13 pf01 php: rc.filter_synchronize: Filter sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:40:24 pf01 sshd[34203]: Did not receive identification string from 222.186.56.43
      Jan  4 00:41:31 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:41:31 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:41:44 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:41:44 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:42:17 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:42:17 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:42:34 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:42:34 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:43:04 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:43:04 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:43:11 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:43:11 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:43:14 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:43:14 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:43:24 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:43:24 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:44:21 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:44:21 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:44:47 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:44:47 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:45:18 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:45:18 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:45:42 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:45:42 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:45:52 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:45:52 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:45:58 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:45:58 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:08 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:08 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:15 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:15 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:18 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:18 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:43 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:43 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:56 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:46:56 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:03 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:03 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:06 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:06 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:13 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:13 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:16 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:16 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:21 pf01 check_reload_status: Syncing firewall
      Jan  4 00:47:24 pf01 php: rc.filter_synchronize: Beginning XMLRPC sync to https://172.16.204.252:443.
      Jan  4 00:47:25 pf01 php: rc.filter_synchronize: XMLRPC sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:47:26 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:26 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:27 pf01 php: rc.filter_synchronize: Filter sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:47:36 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:36 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:40 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:40 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:46 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:46 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:50 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:50 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:53 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:53 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:56 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:47:56 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:00 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:00 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:03 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:03 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:07 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:07 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:10 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:10 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:13 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:13 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:19 pf01 check_reload_status: Syncing firewall
      Jan  4 00:48:20 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:20 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:21 pf01 php: rc.filter_synchronize: Beginning XMLRPC sync to https://172.16.204.252:443.
      Jan  4 00:48:22 pf01 php: rc.filter_synchronize: XMLRPC sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:48:23 pf01 php: rc.filter_synchronize: Filter sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:48:26 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:26 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:36 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:36 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:39 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:39 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:41 pf01 check_reload_status: Syncing firewall
      Jan  4 00:48:43 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:43 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:48:44 pf01 php: rc.filter_synchronize: Beginning XMLRPC sync to https://172.16.204.252:443.
      Jan  4 00:48:45 pf01 php: rc.filter_synchronize: XMLRPC sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:48:46 pf01 php: rc.filter_synchronize: Filter sync successfully completed with https://172.16.204.252:443.
      Jan  4 00:48:53 pf01 check_reload_status: Reloading filter
      Jan  4 00:48:59 pf01 sshd[81620]: Failed password for root from 222.186.56.43 port 2842 ssh2
      Jan  4 00:48:59 pf01 sshd[81620]: Failed password for root from 222.186.56.43 port 2842 ssh2
      Jan  4 00:49:01 pf01 sshd[81620]: Failed password for root from 222.186.56.43 port 2842 ssh2
      Jan  4 00:49:03 pf01 sshd[81620]: Failed password for root from 222.186.56.43 port 2842 ssh2
      Jan  4 00:49:03 pf01 sshd[81620]: Failed password for root from 222.186.56.43 port 2842 ssh2
      Jan  4 00:49:04 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:04 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:08 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:08 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:11 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:11 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:18 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:18 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:21 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:21 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:25 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:25 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:28 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:28 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:35 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:35 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:38 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:38 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:41 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:41 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:48 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:48 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:51 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:51 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:55 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:55 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:58 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:49:58 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:05 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:05 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:14 pf01 sshd[3184]: Failed password for root from 222.186.56.43 port 3942 ssh2
      Jan  4 00:50:14 pf01 sshd[3184]: Failed password for root from 222.186.56.43 port 3942 ssh2
      Jan  4 00:50:14 pf01 sshd[3184]: Failed password for root from 222.186.56.43 port 3942 ssh2
      Jan  4 00:50:15 pf01 sshd[3184]: Failed password for root from 222.186.56.43 port 3942 ssh2
      Jan  4 00:50:15 pf01 sshd[3184]: Failed password for root from 222.186.56.43 port 3942 ssh2
      Jan  4 00:50:16 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:16 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:20 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:20 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:23 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:23 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:26 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:26 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:30 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:30 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:43 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:43 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:53 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:53 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:56 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:50:56 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:51:03 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:51:03 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:51:06 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:51:06 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:51:13 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:51:13 pf01 sshd[11277]: error: accept: Software caused connection abort
      Jan  4 00:51:21 pf01 sshd[42291]: Failed password for root from 222.186.56.43 port 1488 ssh2
      Jan  4 00:51:22 pf01 sshd[42291]: Failed password for root from 222.186.56.43 port 1488 ssh2
      Jan  4 00:51:22 pf01 sshd[42291]: Failed password for root from 222.186.56.43 port 1488 ssh2
      Jan  4 00:51:22 pf01 sshd[42291]: Failed password for root from 222.186.56.43 port 1488 ssh2
      Jan  4 00:51:23 pf01 sshd[42291]: Failed password for root from 222.186.56.43 port 1488 ssh2
      Jan  4 00:51:23 pf01 sshlockout[37765]: Locking out 222.186.56.43 after 15 invalid attempts

      The public IP addresses you see are not mine.

      Thanks,

      1 Reply Last reply Reply Quote 0
      • S
        Supermule Banned last edited by

        DDoS on SSH and it created a buffer overflow and WAN went offline??

        1 Reply Last reply Reply Quote 0
        • J
          jsnicaise last edited by

          Could be something like that. Are you asking a question or are you telling me that's what you think it is? :)

          1 Reply Last reply Reply Quote 0
          • S
            Supermule Banned last edited by

            Thats a guess from here :)

            1 Reply Last reply Reply Quote 0
            • J
              jsnicaise last edited by

              how could I troubleshoot that further than reading from the logs in /var/log ?

              1 Reply Last reply Reply Quote 0
              • S
                Supermule Banned last edited by

                Make your attack surface as small as possible and harden the pfsense box.

                Disable SSH and predefined ports other than the outmost necessary.

                Run Snort with block option enabled and released every 24hrs.

                1 Reply Last reply Reply Quote 0
                • M
                  mir last edited by

                  could it be an idea to have fail2ban as part of a pfsense installation?

                  fail2ban will prevent ddos attacks bringing down ssh.

                  1 Reply Last reply Reply Quote 0
                  • S
                    Supermule Banned last edited by

                    Would be a viable option to have indeed!

                    1 Reply Last reply Reply Quote 0
                    • M
                      mir last edited by

                      Is it possible to add a feature request for fail2ban in pfsense? I think this is important to prevent (D)DOS attacks leading to crash of service so my hope is that it is added to pfsense core and not as a package.

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned last edited by

                        @mir:

                        Is it possible to add a feature request for fail2ban in pfsense? I think this is important to prevent (D)DOS attacks leading to crash of service so my hope is that it is added to pfsense core and not as a package.

                        But it's already there. https://doc.pfsense.org/index.php/Sshlockout

                        1 Reply Last reply Reply Quote 0
                        • S
                          Supermule Banned last edited by

                          Maybe not working then?? or enabled??

                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned last edited by

                            @Supermule:

                            Maybe not working then?? or enabled??

                            Erm… read the logs posted?

                            Jan  4 00:51:23 pf01 sshlockout[37765]: Locking out 222.186.56.43 after 15 invalid attempts

                            Looks damn well working.

                            P.S. None of this protects against DDoS. Not possible. Won't save your WAN from crashing.

                            1 Reply Last reply Reply Quote 0
                            • S
                              Supermule Banned last edited by

                              Yes I can see that :) Thank you.

                              https://doc.pfsense.org/index.php/HOWTO_enable_SSH_access

                              Not a way to configure it. And it seems that all though i disable it on the webgui then it doesnt get disabled in the console menu.

                              ![secure shell.PNG_thumb](/public/imported_attachments/1/secure shell.PNG_thumb)
                              ![secure shell.PNG](/public/imported_attachments/1/secure shell.PNG)

                              1 Reply Last reply Reply Quote 0
                              • S
                                Supermule Banned last edited by

                                The console is responsive ONLY when you enable and disable the sshd.

                                No can do via the gui.

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned last edited by

                                  No idea what are you trying to do with console. Serial console is not SSH.

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    Supermule Banned last edited by

                                    I know…. but you can enable/disable it via the gui and via console.

                                    It doesnt work disabling it via the GUI. Only via the console...

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      doktornotor Banned last edited by

                                      What's IT?!

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        Supermule Banned last edited by

                                        SSH :)

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          doktornotor Banned last edited by

                                          Before disabling SSH via GUI:

                                          
# netstat -an | grep .22
tcp4       0      0 *.22                   *.*                    LISTEN
tcp6       0      0 *.22                   *.*                    LISTEN

                                          After disabling SSH via GUI:

                                          
# netstat -an | grep .22
#

                                          Re-enabling SSH via console:

                                          
# netstat -an | grep .22
tcp4       0      0 *.22                   *.*                    LISTEN
tcp6       0      0 *.22                   *.*                    LISTEN

                                          and checking back the GUI:

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            Supermule Banned last edited by

                                            Doesnt work here…

                                            1 Reply Last reply Reply Quote 0
                                            • KOM
                                              KOM last edited by

                                              P.S. None of this protects against DDoS. Not possible. Won't save your WAN from crashing.

                                              This x 1000.  I don't know why so many people incorrectly think that a simple firewall rule can mitigate a DDoS attack.  I guess someone should tell the netops over at Sony and MS that they should add a firewall rule to stop their entire gaming networks from being blown offline like what happened a week or two ago…

                                              1 Reply Last reply Reply Quote 0
                                              • S
                                                Supermule Banned last edited by

                                                It doesnt stop it or prevent it…

                                                It handles it and doesnt interfere with normal services.

                                                And dont let the security at Sony disturb you at night....if North Korea can get in, everyone can....

                                                1 Reply Last reply Reply Quote 0
                                                • F
                                                  firewalluser last edited by

                                                  @KOM:

                                                  P.S. None of this protects against DDoS. Not possible. Won't save your WAN from crashing.

                                                  This x 1000.  I don't know why so many people incorrectly think that a simple firewall rule can mitigate a DDoS attack.  I guess someone should tell the netops over at Sony and MS that they should add a firewall rule to stop their entire gaming networks from being blown offline like what happened a week or two ago…

                                                  But depending on how your internal network is setup, the initial ddos on the wan could trigger a cascade of network activity which can slow the slower or under heavy load lans as well. With virtualisation becoming more common, the increased activity could also swap some cpu's as well.

                                                  Capitalism, currently The World's best Entertainment Control System and YOU cant buy it! But you can buy this, or some of this or some of these

                                                  Asch Conformity, mainly the blind leading the blind.

                                                  1 Reply Last reply Reply Quote 0
                                                  • S
                                                    Supermule Banned last edited by

                                                    Thats why you have sinkholes and load balanced servers ;)

                                                    1 Reply Last reply Reply Quote 0
                                                    • F
                                                      firewalluser last edited by

                                                      When you can afford it.

                                                      Sadly I dont have GCHQ's or the NSA's budgets.  ;)

                                                      Capitalism, currently The World's best Entertainment Control System and YOU cant buy it! But you can buy this, or some of this or some of these

                                                      Asch Conformity, mainly the blind leading the blind.

                                                      1 Reply Last reply Reply Quote 0
                                                      • First post
                                                        Last post