If a user has been blocked for too many incorrect passwords, what
needs to be done to remove that block??

Also, I noticed that I could INCREASE the block from 10 minutes to 24
hours (1 day)...but the way I've been getting slammed by bots lately, I
upped that to 72 hours (3 days).

That may be overkill, but it keeps the bot traffic down, as it were. I
am noticing more and more systems with that Mirai bot trying to get in.

Also, I'm noticing a lot of Bad/Unrecognized Data format with SSH
logons. Is this something I should be concerned about??

Daryl

---
* OLX 1.53 * News Headline: Male infertility can be passed to children
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

On 2017 Aug 06 22:46:00, you wrote to ALL:

Also, I noticed that I could INCREASE the block from 10 minutes to 24 hours (1 day)...but the way I've been getting slammed by bots lately,
I upped that to 72 hours (3 days).

that's pretty low, IMHO... over here, the IDS blocks for 30+ days for Level 1 (aka severe) alerts...

That may be overkill, but it keeps the bot traffic down, as it were. I
am noticing more and more systems with that Mirai bot trying to get
in.

there are thousands and thousands of them... plus there's an apparent new recruiting campaign going on as i've seen several new variants as well as a surge in older ones that have been around for a while... currently we're tracking 22 variants and are aware of more out there...

)\/(ark

Always Mount a Scratch Monkey
Do you manage your own servers? If you are not running an IDS/IPS yer doin' it wrong...
... We the *purple*? What the hell was that?
---
* Origin: (1:3634/12.73)

Re: UNBLOCKING AND MORE
By: Daryl Stout to ALL on Sun Aug 06 2017 10:46 pm

If a user has been blocked for too many incorrect passwords, what
needs to be done to remove that block??

You mean a temporary ban? Just re-run the BBS.

Also, I'm noticing a lot of Bad/Unrecognized Data format with SSH
logons. Is this something I should be concerned about??

No.

digital man

Synchronet/BBS Terminology Definition #42:
SCFG = Synchronet Configuration Utility
Norco, CA WX: 86.3oF, 47.0% humidity, 16 mph ESE wind, 0.00 inches rain/24hrs --- SBBSecho 3.01-Win32
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Mark,

Also, I noticed that I could INCREASE the block from 10 minutes to 24 hours (1 day)...but the way I've been getting slammed by bots lately,
I upped that to 72 hours (3 days).

that's pretty low, IMHO... over here, the IDS blocks for 30+ days for Level ML>(aka severe) alerts...

Hmmm...I might raise that, then. <G>

there are thousands and thousands of them... plus there's an apparent new ML>recruiting campaign going on as i've seen several new variants as well as a ML>surge in older ones that have been around for a while... currently we're ML>tracking 22 variants and are aware of more out there...

Sheesh. I guess they don't have the maturity or brains to do
constructive things with their programming.

Daryl

---
* OLX 1.53 * Real Sysops read the documentation; or at least skim them
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Rob,

If a user has been blocked for too many incorrect passwords, what
needs to be done to remove that block??

You mean a temporary ban? Just re-run the BBS.

I had to do that last night...for some reason, SBBS Control Panel
crashed. I'd have to dig up the log for details. But, I used the brief
downtime to download and install the new SBBS_DEV.ZIP files.

Also, I'm noticing a lot of Bad/Unrecognized Data format with SSH logons. Is this something I should be concerned about??

No.

OK, good deal.

Daryl

---
* OLX 1.53 * ReinCarnation: Reconstituting Evaporated Milk.
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Re: UNBLOCKING AND MORE
By: mark lewis to Daryl Stout on Mon Aug 07 2017 08:34:02

Also, I noticed that I could INCREASE the block from 10 minutes to
24 hours (1 day)...but the way I've been getting slammed by bots
lately, I upped that to 72 hours (3 days).

that's pretty low, IMHO... over here, the IDS blocks for 30+ days for

Dude, afaik, He's talking about the TEMPORARY blocks that are saved into MEMORY.

I set mine very low (a couple minute) that way if they fail login x amount of time they are put in my ip.can and blocked for good and not wastig that block of memory.

--

Tim Smith (KK4QBN)
KK4QBN BBS

---
* Synchronet * KK4QBN - kk4qbn.synchro.net - 7064229538 - Chatsworth GA USA
* Origin: Vertrauen - vert.synchro.net (1:103/705)