BFD Warning of Attacks...what should I do?

I've installed BFD on my server and its been sending me a few unsettling reports. Here's a copy of the one from yesterday. The report it sent me today is virtually identical (although it only includes one of the IP addresses). It seems as if APF already blocked the user, is there anything else I should do to protect myself from this attacker?

The remote system ffff was found to have exceeded acceptable login failures on server.gtplanet.net. As such the attacking host has been banned from further accessing this system; for the integrity of your host you should investigate this event as soon as possible.

The following are event logs for exceeded login failures from ffff (all time stamps are GMT -0400):
----
- Executed actions:
ffff was found inside a defined exclude file, or host has already been banned.

- Log events from /var/log/secure:
Sep 19 05:25:52 server sshd[20101]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:25:52 server sshd[20099]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:25:52 server sshd[20098]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:25:52 server sshd[20097]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:25:52 server sshd[20100]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:25:52 server sshd[20096]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:25:52 server sshd[20108]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:25:52 server sshd[20109]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:25:53 server sshd[20120]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:25:54 server sshd[20100]: Failed password for illegal user test from ::ffff:207.234.208.13 port 43932 ssh2
Sep 19 05:25:54 server sshd[20096]: Failed password for illegal user test from ::ffff:207.234.208.13 port 43926 ssh2
Sep 19 05:25:54 server sshd[20101]: Failed password for illegal user test from ::ffff:207.234.208.13 port 43938 ssh2
Sep 19 05:25:54 server sshd[20098]: Failed password for illegal user test from ::ffff:207.234.208.13 port 43930 ssh2
Sep 19 05:25:54 server sshd[20099]: Failed password for illegal user test from ::ffff:207.234.208.13 port 43931 ssh2
Sep 19 05:25:54 server sshd[20097]: Failed password for illegal user test from ::ffff:207.234.208.13 port 43928 ssh2
Sep 19 05:25:55 server sshd[20108]: Failed password for illegal user test from ::ffff:207.234.208.13 port 43992 ssh2
Sep 19 05:25:55 server sshd[20109]: Failed password for illegal user test from ::ffff:207.234.208.13 port 43998 ssh2
Sep 19 05:25:55 server sshd[20123]: Illegal user guest from ::ffff:207.234.208.13
Sep 19 05:25:55 server sshd[20126]: Illegal user guest from ::ffff:207.234.208.13
Sep 19 05:25:55 server sshd[20124]: Illegal user guest from ::ffff:207.234.208.13
Sep 19 05:25:55 server sshd[20125]: Illegal user guest from ::ffff:207.234.208.13
Sep 19 05:25:55 server sshd[20127]: Illegal user guest from ::ffff:207.234.208.13
Sep 19 05:25:55 server sshd[20128]: Illegal user guest from ::ffff:207.234.208.13
Sep 19 05:25:55 server sshd[20120]: Failed password for illegal user test from ::ffff:207.234.208.13 port 44014 ssh2
Sep 19 05:25:55 server sshd[20135]: Illegal user guest from ::ffff:207.234.208.13
Sep 19 05:25:55 server sshd[20136]: Illegal user guest from ::ffff:207.234.208.13
Sep 19 05:25:56 server sshd[20141]: Illegal user guest from ::ffff:207.234.208.13
Sep 19 05:25:57 server sshd[20123]: Failed password for illegal user guest from ::ffff:207.234.208.13 port 44128 ssh2
Sep 19 05:25:57 server sshd[20124]: Failed password for illegal user guest from ::ffff:207.234.208.13 port 44129 ssh2
Sep 19 05:25:57 server sshd[20126]: Failed password for illegal user guest from ::ffff:207.234.208.13 port 44131 ssh2
Sep 19 05:25:57 server sshd[20125]: Failed password for illegal user guest from ::ffff:207.234.208.13 port 44130 ssh2
Sep 19 05:25:57 server sshd[20127]: Failed password for illegal user guest from ::ffff:207.234.208.13 port 44132 ssh2
Sep 19 05:25:57 server sshd[20128]: Failed password for illegal user guest from ::ffff:207.234.208.13 port 44133 ssh2
Sep 19 05:25:57 server sshd[20135]: Failed password for illegal user guest from ::ffff:207.234.208.13 port 44160 ssh2
Sep 19 05:25:57 server sshd[20136]: Failed password for illegal user guest from ::ffff:207.234.208.13 port 44162 ssh2
Sep 19 05:25:58 server sshd[20155]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:25:58 server sshd[20157]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:25:58 server sshd[20156]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:25:58 server sshd[20158]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:25:58 server sshd[20159]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:25:58 server sshd[20161]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:25:58 server sshd[20141]: Failed password for illegal user guest from ::ffff:207.234.208.13 port 44179 ssh2
Sep 19 05:25:58 server sshd[20167]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:25:58 server sshd[20168]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:25:58 server sshd[20187]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:00 server sshd[20155]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44254 ssh2
Sep 19 05:26:00 server sshd[20159]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44261 ssh2
Sep 19 05:26:00 server sshd[20156]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44255 ssh2
Sep 19 05:26:00 server sshd[20157]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44256 ssh2
Sep 19 05:26:00 server sshd[20158]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44257 ssh2
Sep 19 05:26:00 server sshd[20161]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44263 ssh2
Sep 19 05:26:00 server sshd[20167]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44283 ssh2
Sep 19 05:26:00 server sshd[20168]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44286 ssh2
Sep 19 05:26:01 server sshd[20190]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:01 server sshd[20192]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:01 server sshd[20191]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:01 server sshd[20193]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:01 server sshd[20194]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:01 server sshd[20196]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:01 server sshd[20187]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44305 ssh2
Sep 19 05:26:01 server sshd[20202]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:01 server sshd[20203]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:01 server sshd[20206]: Illegal user admin from ::ffff:207.234.208.13
Sep 19 05:26:03 server sshd[20190]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44408 ssh2
Sep 19 05:26:03 server sshd[20192]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44413 ssh2
Sep 19 05:26:03 server sshd[20191]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44412 ssh2
Sep 19 05:26:03 server sshd[20193]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44414 ssh2
Sep 19 05:26:03 server sshd[20194]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44415 ssh2
Sep 19 05:26:03 server sshd[20196]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44419 ssh2
Sep 19 05:26:03 server sshd[20202]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44438 ssh2
Sep 19 05:26:03 server sshd[20203]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44440 ssh2
Sep 19 05:26:04 server sshd[20222]: Illegal user user from ::ffff:207.234.208.13
Sep 19 05:26:04 server sshd[20224]: Illegal user user from ::ffff:207.234.208.13
Sep 19 05:26:04 server sshd[20223]: Illegal user user from ::ffff:207.234.208.13
Sep 19 05:26:04 server sshd[20225]: Illegal user user from ::ffff:207.234.208.13
Sep 19 05:26:04 server sshd[20226]: Illegal user user from ::ffff:207.234.208.13
Sep 19 05:26:04 server sshd[20228]: Illegal user user from ::ffff:207.234.208.13
Sep 19 05:26:04 server sshd[20206]: Failed password for illegal user admin from ::ffff:207.234.208.13 port 44460 ssh2
Sep 19 05:26:04 server sshd[20234]: Illegal user user from ::ffff:207.234.208.13
Sep 19 05:26:04 server sshd[20235]: Illegal user user from ::ffff:207.234.208.13
Sep 19 05:26:04 server sshd[20238]: Illegal user user from ::ffff:207.234.208.13
Sep 19 05:26:06 server sshd[20222]: Failed password for illegal user user from ::ffff:207.234.208.13 port 44608 ssh2
Sep 19 05:26:06 server sshd[20224]: Failed password for illegal user user from ::ffff:207.234.208.13 port 44612 ssh2
Sep 19 05:26:06 server sshd[20225]: Failed password for illegal user user from ::ffff:207.234.208.13 port 44613 ssh2
Sep 19 05:26:06 server sshd[20223]: Failed password for illegal user user from ::ffff:207.234.208.13 port 44611 ssh2
Sep 19 05:26:06 server sshd[20226]: Failed password for illegal user user from ::ffff:207.234.208.13 port 44614 ssh2
Sep 19 05:26:06 server sshd[20228]: Failed password for illegal user user from ::ffff:207.234.208.13 port 44616 ssh2
Sep 19 05:26:06 server sshd[20234]: Failed password for illegal user user from ::ffff:207.234.208.13 port 44628 ssh2
Sep 19 05:26:06 server sshd[20235]: Failed password for illegal user user from ::ffff:207.234.208.13 port 44634 ssh2
Sep 19 05:26:07 server sshd[20238]: Failed password for illegal user user from ::ffff:207.234.208.13 port 44663 ssh2
Sep 19 05:26:09 server sshd[20288]: Failed password for root from ::ffff:207.234.208.13 port 44947 ssh2
Sep 19 05:26:09 server sshd[20291]: Failed password for root from ::ffff:207.234.208.13 port 44961 ssh2
Sep 19 05:26:09 server sshd[20289]: Failed password for root from ::ffff:207.234.208.13 port 44956 ssh2
Sep 19 05:26:09 server sshd[20290]: Failed password for root from ::ffff:207.234.208.13 port 44960 ssh2
Sep 19 05:26:09 server sshd[20293]: Failed password for root from ::ffff:207.234.208.13 port 44964 ssh2
Sep 19 05:26:09 server sshd[20294]: Failed password for root from ::ffff:207.234.208.13 port 44965 ssh2
Sep 19 05:26:09 server sshd[20300]: Failed password for root from ::ffff:207.234.208.13 port 44979 ssh2
Sep 19 05:26:09 server sshd[20301]: Failed password for root from ::ffff:207.234.208.13 port 44983 ssh2
Sep 19 05:26:10 server sshd[20304]: Failed password for root from ::ffff:207.234.208.13 port 45014 ssh2
Sep 19 05:26:12 server sshd[20306]: Failed password for root from ::ffff:207.234.208.13 port 45177 ssh2
Sep 19 05:26:12 server sshd[20308]: Failed password for root from ::ffff:207.234.208.13 port 45184 ssh2
Sep 19 05:26:12 server sshd[20307]: Failed password for root from ::ffff:207.234.208.13 port 45183 ssh2
Sep 19 05:26:12 server sshd[20311]: Failed password for root from ::ffff:207.234.208.13 port 45186 ssh2
Sep 19 05:26:12 server sshd[20309]: Failed password for root from ::ffff:207.234.208.13 port 45185 ssh2
Sep 19 05:26:12 server sshd[20312]: Failed password for root from ::ffff:207.234.208.13 port 45190 ssh2
Sep 19 05:26:12 server sshd[20317]: Failed password for root from ::ffff:207.234.208.13 port 45202 ssh2
Sep 19 05:26:12 server sshd[20319]: Failed password for root from ::ffff:207.234.208.13 port 45206 ssh2
Sep 19 05:26:12 server sshd[20322]: Failed password for root from ::ffff:207.234.208.13 port 45231 ssh2
Sep 19 05:26:15 server sshd[20327]: Failed password for root from ::ffff:207.234.208.13 port 45379 ssh2
Sep 19 05:26:15 server sshd[20328]: Failed password for root from ::ffff:207.234.208.13 port 45381 ssh2
Sep 19 05:26:15 server sshd[20329]: Failed password for root from ::ffff:207.234.208.13 port 45382 ssh2
Sep 19 05:26:15 server sshd[20331]: Failed password for root from ::ffff:207.234.208.13 port 45383 ssh2
Sep 19 05:26:15 server sshd[20337]: Failed password for root from ::ffff:207.234.208.13 port 45388 ssh2
Sep 19 05:26:15 server sshd[20336]: Failed password for root from ::ffff:207.234.208.13 port 45384 ssh2
Sep 19 05:26:15 server sshd[20343]: Failed password for root from ::ffff:207.234.208.13 port 45393 ssh2
Sep 19 05:26:15 server sshd[20344]: Failed password for root from ::ffff:207.234.208.13 port 45394 ssh2
Sep 19 05:26:15 server sshd[20347]: Failed password for root from ::ffff:207.234.208.13 port 45426 ssh2
Sep 19 05:26:15 server sshd[20374]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:26:15 server sshd[20373]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:26:16 server sshd[20375]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:26:16 server sshd[20379]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:26:16 server sshd[20376]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:26:16 server sshd[20380]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:26:16 server sshd[20382]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:26:16 server sshd[20386]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:26:16 server sshd[20389]: Illegal user test from ::ffff:207.234.208.13
Sep 19 05:26:18 server sshd[20373]: Failed password for illegal user test from ::ffff:207.234.208.13 port 45595 ssh2
Sep 19 05:26:18 server sshd[20374]: Failed password for illegal user test from ::ffff:207.234.208.13 port 45597 ssh2
Sep 19 05:26:18 server sshd[20376]: Failed password for illegal user test from ::ffff:207.234.208.13 port 45603 ssh2
Sep 19 05:26:18 server sshd[20375]: Failed password for illegal user test from ::ffff:207.234.208.13 port 45602 ssh2
Sep 19 05:26:18 server sshd[20379]: Failed password for illegal user test from ::ffff:207.234.208.13 port 45607 ssh2
Sep 19 05:26:18 server sshd[20380]: Failed password for illegal user test from ::ffff:207.234.208.13 port 45608 ssh2
Sep 19 05:26:18 server sshd[20382]: Failed password for illegal user test from ::ffff:207.234.208.13 port 45614 ssh2
Sep 19 05:26:18 server sshd[20386]: Failed password for illegal user test from ::ffff:207.234.208.13 port 45616 ssh2
Sep 19 05:26:18 server sshd[20389]: Failed password for illegal user test from ::ffff:207.234.208.13 port 45636 ssh2
----

 

 

 

 

Top