Opened 9 years ago

Closed 9 years ago

#135 closed incident (fixed)

disable ssh-tun on all proxies

Reported by: rick Owned by:
Keywords: ssh-tun Cc:
Location: Generiek

Description

De (stukke) ssh-tun functionaliteit zorgt ervoor dat op sunfire een hoop proxies proberen in te loggen elke dag (wat een hoop noise in de log oplevert). Het zou handig zijn om dit (als een hack) op alle proxies eruit te slopen.

Change History (8)

comment:1 Changed 9 years ago by richardvm

Staat uit op de nieuwe proxies. Als ze geupdate worden verdwijnt het 'gezeur'

comment:2 Changed 9 years ago by richardvm

handmatig utigezet, bij reboot staat die weer aan. Tijd voor de nieuwe proxies

comment:3 Changed 9 years ago by richardvm

Resolution: worksforme
Status: newclosed

comment:4 Changed 9 years ago by huub

Resolution: worksforme
Status: closedreopened

Niet zo zinvol: proxies (Soekris) rebooten elke nacht (ivm out of swap probleem).

comment:5 Changed 9 years ago by huub

Resolution: fixed
Status: reopenedclosed

Ik heb in /cfg/rc.conf.local de sshtun_enable op "NO" gezet.

comment:6 Changed 9 years ago by rick

Resolution: fixed
Status: closedreopened

sunfire% sudo head -1 /var/log/auth.log

Mar 19 10:00:00 sunfire newsyslog[48001]: logfile turned over due to size>100K
sunfire% sudo grep ssh-tun /var/log/auth.log | awk '{print $NF}' | sort | uniq -c

25 195.240.197.153
29 212.182.169.157
29 213.125.162.254
28 217.166.167.179
29 80.126.224.148
71 82.161.92.14
29 82.215.32.97
18 82.215.33.102
28 82.95.180.27
29 83.160.119.88
28 83.160.182.75
27 83.162.36.91
27 83.86.204.79

103 92.66.227.162
104 92.70.57.233

28 94.209.113.8

sunfire% sudo tail -1 /var/log/auth.log

Mar 20 07:01:42 sunfire sshd[58012]: Accepted publickey for rvdzwet from 83.86.204.79 port 59797 ssh2

comment:7 Changed 9 years ago by rick

Sorry only the ones from Mar 20 of course (as it was still running yesterday):

We missed two:

sunfire% sudo grep 'Mar 20' /var/log/auth.log | grep Invalid | awk '{print $NF}' | sort | uniq -c
   4 82.215.33.102
  78 92.66.227.162

comment:8 Changed 9 years ago by rick

Resolution: fixed
Status: reopenedclosed

Removed on all proxies.

Note: See TracTickets for help on using tickets.