Hacked Linode customer?

Question

Hacked Linode customer?

general

neonnero 14 years, 10 months ago

I manage a Linode for someone else, and based on a finding in one of the daily logwatch reports, I noticed the following in auth.log:

Sep 22 12:09:53 localhost sshd[27408]: Invalid user globus from 97.107.135.77
Sep 22 12:09:53 localhost sshd[27408]: (pam_unix) check pass; user unknown
Sep 22 12:09:53 localhost sshd[27408]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=li65-77.members.linode.com
Sep 22 12:09:55 localhost sshd[27408]: Failed password for invalid user globus from 97.107.135.77 port 59198 ssh2
Sep 22 12:11:21 localhost sshd[27410]: Invalid user cadi from 97.107.135.77
Sep 22 12:11:21 localhost sshd[27410]: (pam_unix) check pass; user unknown
Sep 22 12:11:21 localhost sshd[27410]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=li65-77.members.linode.com
Sep 22 12:11:22 localhost sshd[27410]: Failed password for invalid user cadi from 97.107.135.77 port 44401 ssh2
Sep 22 12:11:22 localhost sshd[27412]: Invalid user cady from 97.107.135.77
Sep 22 12:11:22 localhost sshd[27412]: (pam_unix) check pass; user unknown
Sep 22 12:11:23 localhost sshd[27412]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=li65-77.members.linode.com
Sep 22 12:11:25 localhost sshd[27412]: Failed password for invalid user cady from 97.107.135.77 port 45549 ssh2

To the person who has that IP address: Please check your system for trojans, hackers, etc.

4 Replies

forum:Guspaz · Answer 1 · Sept. 24, 2009, 11:06 a.m.

forum:Guspaz 14 years, 10 months ago

It's highly unlikely that that person will see your post. You should report it to Linode themselves so that they can contact the affected customer and take appropriate action. If you have access to the Linode control panel, you can open a trouble ticket. If not, you can contact service@linode.com (I can't find an abuse address, but you might try abuse@linode.com too).

forum:mwalling · Answer 2 · Sept. 24, 2009, 11:10 a.m.

forum:mwalling 14 years, 10 months ago

````
mwalling@youtoo:~$ whois 97.107.135.77 | grep abuse
RAbuseEmail: abuse@linode.com
OrgAbuseEmail: abuse@linode.com

````

forum:unixfool · Answer 3 · Sept. 24, 2009, 11:14 a.m.

forum:unixfool 14 years, 10 months ago

~~@mwalling:~~

mwalling@youtoo:~$ whois 97.107.135.77 | grep abuse
RAbuseEmail:  abuse@linode.com
OrgAbuseEmail:  abuse@linode.com

I was close to mentioning that but I thought it was a bit obvious. :)

forum:redbook · Answer 4 · Oct. 2, 2009, 7:25 a.m.

forum:redbook 14 years, 9 months ago

Have a look at fail2ban - scans log for auth failures and automatically blocks the IP address either via iptables or denyhosts.

Compute

Storage

Databases

Networking

Developer Tools

Delivery

Security

Services

Industries

Pricing

Community

Engage With Us

Hacked Linode customer?

4 Replies

Reply

Tips: