Recently I blocked the SSH port 22 and turned it off in Synchronet control panel since I log in either through my home network or Telnet only.
Most of the unwanted port sniffing bot traffic is now gone or rejected.
I use two firewalls on my Synchronet PC, the windows firewall and my router firewall.
Seems like the snifbots are assuming I run on a Linux machine as they are trying to access my root directory, this weekend I plan to do a country ip block on certain countries like china, even if they were able to gain controll of my Synchronet PC they would not get any useful information.
/s

---
þ Synchronet þ The Outwest BBS - outwestbbs.com - DOORS - Files -Dove-Net

Seems like the snifbots are assuming I run on a Linux machine as they are trying to access my root directory

For that reason, I'm not sure if they're really harmful for Synchronet systems. I doubt they can gain access to your system through the Synchronet SSH server, and if they try to log in as 'root' etc., they're not going to get in, unless you happen to have a BBS user named 'root' (which is unlikely).

Nightfox

---
þ Synchronet þ Digital Distortion: digitaldistortionbbs.com

For that reason, I'm not sure if they're really harmful for Synchronet systems. I doubt they can gain access to your system through the Synchronet SSH server, and if they try to log in as 'root' etc., they're not going to get in, unless you happen to have a BBS user named 'root' (which is unlikely).

I guess the only really annoyance it's the node that are taking and the log they are filling :-)

---
þ Synchronet þ MtlGeek - Geeks in Montreal - http://mtlgeek.com/ -

I guess the only really annoyance it's the node that are taking and the log they are filling :-)

That's true.. For a while I started blocking IPs in my router so that they wouldn't even hit my BBS machine..

Nightfox

---
þ Synchronet þ Digital Distortion: digitaldistortionbbs.com

Re: SSH
By: Nightfox to Denn Gray on Thu Mar 23 2017 09:16 am

For that reason, I'm not sure if they're really harmful for Synchronet systems. I doubt they can gain access to your system through the Synchronet SSH server, and if they try to log in as 'root' etc., they're not going to get in, unless you happen to have a BBS user named 'root' (which is unlikely).

Actually had one get in on my guest account the other day, I logged in the BBS and the caller list popped up and it showed a Guest login with location of /bin/busybox Mirai.

That is the furthest I've ever seen one get.

--

Tim Smith (KK4QBN)
KK4QBN BBS

---
þ Synchronet þ KK4QBN + (706)-422-9538 + kk4qbn.synchro.net + 24/7/365

Re: Re: SSH
By: Ennev to Nightfox on Thu Mar 23 2017 03:27 pm

I guess the only really annoyance it's the node that are taking and the log they are filling :-)

I have 10 nodes and only the first two nodes are affected
If I had a Linux box I could run a cron job to delete the logs every so often, not sure if windows has something similar.
/a

---
þ Synchronet þ The Outwest BBS - outwestbbs.com - DOORS - Files -Dove-Net

I have 10 nodes and only the first two nodes are affected
If I had a Linux box I could run a cron job to delete the logs every so often, not sure if windows has something similar.
/a

Someone could call a scheduled task calling a script that would do that.

I guess it's all about the volume, some are getting hit hard sometime.

It could be hard to cope with a DDOS, since even if the firewall or router would block the packet they would still saturate the traffic.

I remember a couple of years ago when the google bots was login to my ftp service every second to try to enter anonymously. In http you have a robot.txt but I had no way to make them stop. It it was google. nice.

---
þ Synchronet þ MtlGeek - Geeks in Montreal - http://mtlgeek.com/ -

Re: SSH
By: KK4QBN to Nightfox on Thu Mar 23 2017 07:49 pm

Actually had one get in on my guest account the other day, I logged in the B and the caller list popped up and it showed a Guest login with location of /bin/busybox Mirai.

I was getting that alot, now I get User unknown 'ROOT'

---
þ Synchronet þ The Outwest BBS - outwestbbs.com - DOORS - Files -Dove-Net

Re: SSH
By: KK4QBN to Nightfox on Thu Mar 23 2017 07:49 pm

For that reason, I'm not sure if they're really harmful for
Synchronet systems. I doubt they can gain access to your system
through the Synchronet SSH server, and if they try to log in as
'root' etc., they're not going to get in, unless you happen to have
a BBS user named 'root' (which is unlikely).

Actually had one get in on my guest account the other day, I logged in the BBS and the caller list popped up and it showed a Guest login with location of /bin/busybox Mirai.

That is the furthest I've ever seen one get.

I have caught a few stuck there after logging in. The Bot doesn't know what to do once it gets into the guest account. It's kind of funny.

I have actually done a Node Spy on them at that point, and since it is just sitting there, I hit enter a couple of times so the Bot gets to the Weather Door, and I can see what country the IP is from. They come from all over, including the US.

I get hits like that every day now. They used to show up with the same location you saw: "/bin/busybox Mirai", but more often now I see just "Shell" or "Sh".

Mostly just annoying since I have the Guest account locked down fairly well. The bot could play Oregon Trail or Star Trek if it really wanted :-P

~KenDB3

---
þ Synchronet þ KD3net-Rhode Island's only BBS about nothing. http://bbs.kd3.us

Re: Re: SSH
By: Denn Gray to Ennev on Thu Mar 23 2017 10:27 pm

I guess the only really annoyance it's the node that are taking and
the log they are filling :-)

I have 10 nodes and only the first two nodes are affected
If I had a Linux box I could run a cron job to delete the logs every so often, not sure if windows has something similar.

I see it fill up about 4 to 6 nodes sometimes, but I am not sure if that is Mirai or not. I get the occassional bot/script that fills up 10 or even 20 nodes, but that is really rare. I used to grab the IP, do a whois, and send an abuse ticket to the ISP that controls the IP. But, the volume is so much these days that it is useless and a complete waste of my time.

~KenDB3

---
þ Synchronet þ KD3net-Rhode Island's only BBS about nothing. http://bbs.kd3.us

Re: SSH
By: Denn Gray to KK4QBN on Fri Mar 24 2017 08:20 am

location of /bin/busybox Mirai.

I was getting that alot, now I get User unknown 'ROOT'

check your username filter and make sure root and all the other popular admin names are put in.

--

Tim Smith (KK4QBN)
KK4QBN BBS

---
þ Synchronet þ KK4QBN + (706)-422-9538 + kk4qbn.synchro.net + 24/7/365

I have caught a few stuck there after logging in. The Bot doesn't know what to do once it gets into the guest account. It's kind of funny.

Theses bot don't expect a BBS but just an unprotected bash shell. So the
script they made will just do the pre-established step and that's it, no brain behind it.

Still, it's annoying. Sorry, my bbs is not Hudson Bay Company with non-encrypted csv file of all the credit cards data they processed.

---
þ Synchronet þ MtlGeek - Geeks in Montreal - http://mtlgeek.com/ -

Re: SSH
By: KenDB3 to KK4QBN on Fri Mar 24 2017 01:24 pm

Actually had one get in on my guest account the other day, I logged in BBS and the caller list popped up and it showed a Guest login with location of /bin/busybox Mirai.

I have had several sucessful logins by bots to my Guest account.
I just added a password so that should stop the bots there.
I also get the /bin/busybox Mirai
as well as Unknown User "ROOT" "SHELL" "SSH" etc....
looks like the measures I've taken has reduced the bot traffic by a significant amount.

---
þ Synchronet þ The Outwest BBS - outwestbbs.com - DOORS - Files -Dove-Net

Re: Re: SSH
By: KenDB3 to Denn Gray on Fri Mar 24 2017 01:27 pm

I see it fill up about 4 to 6 nodes sometimes, but I am not sure if that is Mirai or not. I get the occassional bot/script that fills up 10 or even 20 nodes, but that is really rare. I used to grab the IP, do a whois, and send abuse ticket to the ISP that controls the IP. But, the volume is so much the days that it is useless and a complete waste of my time.

a couple of years ago I had DDOS'ers attacking my Game servers, since I run those servers on Linux Ubuntu I just enabled UFW and just opened the ports needed to run the game server and that ended the DDOS attacks.

---
þ Synchronet þ The Outwest BBS - outwestbbs.com - DOORS - Files -Dove-Net

Re: SSH
By: KK4QBN to Denn Gray on Fri Mar 24 2017 01:56 pm

check your username filter and make sure root and all the other popular admi names are put in.

Ok will do thanks for the tip.

---
þ Synchronet þ The Outwest BBS - outwestbbs.com - DOORS - Files -Dove-Net