Slashdot Mirror
Dealing with Intruders?
drakyri asks: "I've been running a server for a small company for a few months. Recently, the number of attempted intrusions has jumped from about one every week to several per day - and these are only the really obvious attempts, like idiots who try to log in as root from the outside.
The problem is that I'm not sure what to do about this. I've got their IP addresses and can usually tracert their ISP's - is there an accepted type of letter to send them without seeming like one of the corporate cease-and-desist gnomes?"
I accidentally log in as root all the time. I have to do 90% of my linux work as root (editing /etc files and stopping and starting daemons), so if I ssh or scp to an outside network, It uses my current user name by default: root. And even when I get a login: prompt, my natural instinct is type root.
That said, I have seen an increase of root/guest/temp/ ssh login attempts on my home DSL router/firewall. The IPs tend to be similar to mine, and there are 7-10 attempts in a row. So I'm guessing there is script or worm on the lose that searches nearby IPs for vulnerable hosts.