Groups > linux.debian.user > #219643

Re: Connection closed by [IP] port [port] [preauth]

From	Didar Hossain <didar@purlo.in>
Newsgroups	linux.debian.user
Subject	Re: Connection closed by [IP] port [port] [preauth]
Date	2020-02-29 10:00 +0100
Message-ID	<zF68x-5O8-3@gated-at.bofh.it> (permalink)
References	<zDsGe-7jU-5@gated-at.bofh.it> <zDCcx-5N8-3@gated-at.bofh.it> <zDYPL-2Sg-5@gated-at.bofh.it> <zDZCa-3n5-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Feb 26, 2020 at 08:49:28AM +0100, Klaus Singvogel wrote:
> deloptes wrote:
> > +1 :( and I am not using standard port 22, so they scanned all 30000 ports
> > and found out what is open (well filtered) and now are trying to do brute
> > force on SSH. Others are trying to exploit apache/php & Co.
> 
> I'm using portsentry against this:
> https://packages.debian.org/buster/portsentry
> 
> Let it sniff on some unused ports, like 445, 69, 8181, 5353, or 22. :-)
> 
> https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
> 
> But beware to have a whitelisted IP address active. I locked myslef out,
> after switching to a different computer, like fresh a installed Linux. :-)

"fwknop" is another tool to consider if you don't like getting scanned.

Regards,
Didar

> 
> Regards,
> 	Klaus.
> -- 
> Klaus Singvogel
> GnuPG-Key-ID: 1024R/5068792D  1994-06-27
> 

-- 
Basic Definitions of Science:
	If it's green or wiggles, it's biology.
	If it stinks, it's chemistry.
	If it doesn't work, it's physics.

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Connection closed by [IP] port [port] [preauth] steve <dlist@bluewin.ch> - 2020-02-24 21:40 +0100
  Re: Connection closed by [IP] port [port] [preauth] Dan Ritter <dsr@randomstring.org> - 2020-02-24 22:00 +0100
    Re: Connection closed by [IP] port [port] [preauth] steve <dlist@bluewin.ch> - 2020-02-26 07:10 +0100
  Re: Connection closed by [IP] port [port] [preauth] john doe <johndoe65534@mail.com> - 2020-02-24 22:10 +0100
  Re: Connection closed by [IP] port [port] [preauth] Tixy <tixy@yxit.co.uk> - 2020-02-25 07:50 +0100
    Re: Connection closed by [IP] port [port] [preauth] deloptes <deloptes@gmail.com> - 2020-02-26 08:00 +0100
      Re: Connection closed by [IP] port [port] [preauth] Klaus Singvogel <deb-user-ml@singvogel.net> - 2020-02-26 08:50 +0100
        Re: Connection closed by [IP] port [port] [preauth] Didar Hossain <didar@purlo.in> - 2020-02-29 10:00 +0100

csiph-web