Did I get hacked? or attempted hack?
Linux RH9Karnet 2.4 (host recently updated)
Firewall APF
Log from webmin
I do not understand this, but, I see failed login attempt from 211.234.100.105 !!!
Could some one explain me this log please
Code:
--------------------- Cron Begin ------------------------
**Unmatched Entries**
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
--------------------- Kernel Begin ------------------------
Dropped 17 packets on interface eth0
From 81.241.147.226 - 1 packet
To **.***.***.23 - 1 packet
Service: http (udp/80) (** IN_UDP DROP **,eth0,none) - 1 packet
From 202.97.174.217 - 2 packets
To **.***.***.24 - 2 packets
Service: 49880 (tcp/49880) (** IN_TCP DROP **,eth0,none) - 2 packets
From 218.56.172.124 - 3 packets
To **.***.***.25 - 3 packets
Service: 1025 (tcp/1025) (** IN_TCP DROP **,eth0,none) - 3 packets
From 219.145.48.18 - 3 packets
To **.***.***.26 - 3 packets
Service: 1025 (tcp/1025) (** IN_TCP DROP **,eth0,none) - 3 packets
From 219.150.20.72 - 3 packets
To **.***.***.26 - 3 packets
Service: 1025 (tcp/1025) (** IN_TCP DROP **,eth0,none) - 3 packets
From 220.192.143.210 - 3 packets
To **.***.***.23 - 3 packets
Service: 1025 (tcp/1025) (** IN_TCP DROP **,eth0,none) - 3 packets
From 222.241.219.50 - 2 packets
To **.***.***.23 - 2 packets
Service: 1025 (tcp/1025) (** IN_TCP DROP **,eth0,none) - 2 packets
---------------------- Kernel End -------------------------
--------------------- Named Begin ------------------------
**Unmatched Entries**
stopping command channel on 127.0.0.1#953: 2 Time(s)
zone 0.0.127.in-addr.arpa/IN: loaded serial 1*97*22*0*: 2 Time(s)
zone localhost/IN: loaded serial 42: 2 Time(s)
zone ******.com/IN: loaded serial *0*33*76*7: 2 Time(s)
zone ******.com/IN: sending notifies (serial *0*33*76*7): 2 Time(s)
---------------------- Named End -------------------------
--------------------- pam_unix Begin ------------------------
sshd:
Authentication Failures:
root (211.234.100.105 ): 15 Time(s)
---------------------- pam_unix End -------------------------
--------------------- sendmail Begin ------------------------
1 messages returned after 4 hours
Unknown hosts:
2.hotmail.com: 1 Times(s)
**Unmatched Entries**
DSN: User unknown: 3 Time(s)
STARTTLS=client, relay=tfcgaschamber.com., version=TLSv1/SSLv3, verify=FAIL, cipher=DES-CBC3-SHA,
bits=168/168: 1 Time(s)
STARTTLS=client, relay=incoming02.mail.msu.edu., version=TLSv1/SSLv3, verify=FAIL,
cipher=AES256-SHA, bits=256/256: 1 Time(s)
STARTTLS=client, relay=mail.dshield.org., version=TLSv1/SSLv3, verify=FAIL, cipher=AES256-SHA,
bits=256/256: 1 Time(s)
---------------------- sendmail End -------------------------
Failed logins from these:
root/password from 211.234.100.105: 15 Time(s)
---------------------- Cron End -------------------------
**Unmatched Entries**
Illegal user test from 211.234.100.105
Illegal user guest from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user user from 211.234.100.105
Illegal user test from 211.234.100.105
Illegal user test from 211.234.100.105
Illegal user test from 211.234.100.105
Illegal user test from 211.234.100.105
Illegal user guest from 211.234.100.105
Illegal user guest from 211.234.100.105
Illegal user guest from 211.234.100.105
Illegal user guest from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user admin from 211.234.100.105
Illegal user user from 211.234.100.105
Illegal user user from 211.234.100.105
Illegal user user from 211.234.100.105
Illegal user user from 211.234.100.105
Illegal user test from 211.234.100.105
Illegal user test from 211.234.100.105
Illegal user test from 211.234.100.105
Illegal user test from 211.234.100.105
Illegal user test from 211.234.100.105
sshd -TERM succeeded
succeeded
sshd -TERM succeeded
succeeded

