Subject: Re: NetBSD-3.1 was attacked: Bug of SSHD or cyrus-sasl?
To: David Sheryn <>
From: Jasper Wallace <>
List: tech-pkg
Date: 01/12/2007 23:12:57
Hash: SHA1

On Fri, 12 Jan 2007, David Sheryn wrote:

> On Fri, 12 Jan 2007, Eric Rudolph Pizzani wrote:
>> Date: Fri, 12 Jan 2007 22:20:12 +1100 (EST)
>> From: Eric Rudolph Pizzani <>
>> To: Water NB <>
>> Cc:,,,
>> Subject: Re: NetBSD-3.1 was attacked: Bug of SSHD or cyrus-sasl?
>> I've had someone do something similar on not only my NetBSD on Alpha, but also
>> Debian running on m68k. Although from what I could tell the guy couldn't get
>> in but same kind of thing, always tries stupid names like mgrt1 or something,
>> and just common first names, as well as account names like root and admin. All
>> night. It was coming from some place that had an empty website (that is, it
>> was running a web server). Can't remember where from now. He also tried to
>> break a friend's linux i386 box in much the same fasion. I'm kind of eager to
>> find out how he managed to break the cyrus account. I suppose the best
>> temporary solution is to change all non-user accounts to use nologin? Is there
>> a way of implementing a block on any IP addresses that try to login too much?
>> That would probably slow down the crackers ability to brute force a login, or
>> whatever it is that he does.
> or similar ? (not tried it myself)  Any
> other suggestions ?

I use blockhosts myself:

it uses the spawn feature of tcpwrappers so dosn't rely on log parseing.

do remember to whitelist ip's you frequently use in hosts.allow!

- -- 
[]                                   [0x2ECA0975]
Version: GnuPG v1.4.6 (NetBSD)