1. Forum
  2. FidoNet
  3. SYNC SYSOPS

  • SSH error...

    From Bill McGarrity@1:103/705 to All on Wed Apr 4 23:19:01 2018
    Hiya all..

    Can someone please explain this:

    4/4 10:54:51p 1380 SSH connection accepted from: 185.222.209.108 port
    49347
    4/4 10:54:56p 1380 SSH active channel 'direct-tcpip' is not 'session', disconnecting.
    4/4 10:54:56p 1380 SSH session establishment failed


    Is there a fix?

    Thanks..

    --

    Bill

    Telnet: tequilamockingbirdonline.net
    Web: bbs.tequilamockingbirdonline.net
    FTP: ftp.tequilamockingbirdonline.net:2121
    IRC: irc.tequilamockingbirdonline.net Ports: 6661-6670 SSL: 6697
    Radio: radio.tequilamockingbirdonline.net:8010/live

    ---
    * Synchronet * TequilaMockingbird Online - Toms River, NJ
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Digital Man@1:103/705 to Bill McGarrity on Wed Apr 4 21:19:31 2018
    Re: SSH error...
    By: Bill McGarrity to All on Wed Apr 04 2018 11:19 pm

    Hiya all..

    Can someone please explain this:

    4/4 10:54:51p 1380 SSH connection accepted from: 185.222.209.108 port 49347
    4/4 10:54:56p 1380 SSH active channel 'direct-tcpip' is not 'session', disconnecting.
    4/4 10:54:56p 1380 SSH session establishment failed

    Someone is trying to use your SSH server as a proxy (port-forwarder), most likelyk to attack other hosts on the Internet.

    Is there a fix?

    The SSH session was refused, so Synchronet's working correctly. It's considered a "bad login" (in the latest main.cpp), so enough of those from the same IP and they should be temp-ban or per-blocked automatically.

    digital man

    Synchronet "Real Fact" #15:
    SBBSecho was introduced (replacing SBBSFIDO) for Synchronet v2 in 1994.
    Norco, CA WX: 55.3oF, 89.0% humidity, 6 mph ENE wind, 0.00 inches rain/24hrs --- SBBSecho 3.04-Linux
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Bill McGarrity@1:266/404 to Digital Man on Thu Apr 5 01:02:00 2018
    Digital Man wrote to Bill McGarrity on 04-04-18 21:19 <=-

    By: Bill McGarrity to All on Wed Apr 04 2018 11:19 pm

    Hiya all..

    Can someone please explain this:

    4/4 10:54:51p 1380 SSH connection accepted from: 185.222.209.108 port 49347
    4/4 10:54:56p 1380 SSH active channel 'direct-tcpip' is not 'session', disconnecting.
    4/4 10:54:56p 1380 SSH session establishment failed

    Someone is trying to use your SSH server as a proxy (port-forwarder),
    most likelyk to attack other hosts on the Internet.

    Bastards!! ;)

    Is there a fix?

    The SSH session was refused, so Synchronet's working correctly. It's considered a "bad login" (in the latest main.cpp), so enough of those
    from the same IP and they should be temp-ban or per-blocked
    automatically.

    As usual, you have all the bases covered.

    Thank you..


    --

    Bill

    Telnet: tequilamockingbirdonline.net
    Web: bbs.tequilamockingbirdonline.net
    FTP: ftp.tequilamockingbirdonline.net:2121
    IRC: irc.tequilamockingbirdonline.net Ports: 6661-6670 SSL: +6697
    Radio: radio.tequilamockingbirdonline.net:8010/live


    ... Look Twice... Save a Life!!! Motorcycles are Everywhere!!!
    --- MultiMail/Win32 v0.50
    * Origin: TequilaMockingbird Online - Toms River, NJ (1:266/404)
  • From mark lewis@1:3634/12.73 to Bill McGarrity on Fri Apr 6 00:53:06 2018

    On 2018 Apr 04 21:19:30, Digital Man wrote to you:
    4/4 10:54:51p 1380 SSH connection accepted from: 185.222.209.108 port
    49347
    4/4 10:54:56p 1380 SSH active channel 'direct-tcpip' is not
    'session', disconnecting.
    4/4 10:54:56p 1380 SSH session establishment failed

    Someone is trying to use your SSH server as a proxy (port-forwarder), most likelyk to attack other hosts on the Internet.

    interestingly enough, we have 65 188.*.*.* entries in the perimeter block list managed by our IDS but none of them are 188.222.*.*...

    depending on the required information, you could maybe file a complaint with their abuse department...

    $ whois 185.222.209.108
    % This is the RIPE Database query service.
    % The objects are in RPSL format.
    %
    % The RIPE Database is subject to Terms and Conditions.
    % See http://www.ripe.net/db/support/db-terms-conditions.pdf

    % Note: this output has been filtered.
    % To receive output for a database update, use the "-B" flag.

    % Information related to '185.222.209.0 - 185.222.209.255'

    % Abuse contact for '185.222.209.0 - 185.222.209.255' is 'abuse@daccess.org'

    inetnum: 185.222.209.0 - 185.222.209.255
    netname: DACCESS-NET
    descr: ALLOCATED to end client
    country: NL
    admin-c: DAML1-RIPE
    tech-c: DAML1-RIPE
    org: ORG-DAML2-RIPE
    mnt-routes: HOSTKEY-MNT
    mnt-routes: daaccessuk
    mnt-domains: daaccessuk
    status: SUB-ALLOCATED PA
    mnt-by: uk-cloud-core-1-mnt
    created: 2017-12-12T15:39:16Z
    last-modified: 2017-12-12T15:39:16Z
    source: RIPE

    organisation: ORG-DAML2-RIPE
    org-name: DIRECT ACCESS & MAINTENANCE LIMITED
    org-type: OTHER
    address: 33 Caddywell Meadow, Torrington, Devon EX38 7NZ
    address: United Kingdom
    admin-c: DAML1-RIPE
    tech-c: DAML1-RIPE
    abuse-c: DAML1-RIPE
    mnt-ref: uk-cloud-core-1-mnt
    mnt-by: daaccessuk
    created: 2017-12-12T15:27:20Z
    last-modified: 2017-12-12T15:27:20Z
    source: RIPE # Filtered

    role: DIRECT ACCESS & MAINTENANCE LIMITED NOC
    address: 33 Caddywell Meadow, Torrington, Devon EX38 7NZ
    address: United Kingdom
    phone: +44.185651729
    abuse-mailbox: abuse@daccess.org
    admin-c: BS10409-RIPE
    tech-c: BS10409-RIPE
    fax-no: +44.185651729
    nic-hdl: DAML1-RIPE
    mnt-by: daaccessuk
    created: 2017-12-12T15:24:28Z
    last-modified: 2017-12-12T15:24:28Z
    source: RIPE # Filtered

    % Information related to '185.222.209.0/24as57043'

    route: 185.222.209.0/24
    descr: abuse@daccess.org
    origin: as57043
    mnt-by: HOSTKEY-MNT
    created: 2017-12-12T16:01:51Z
    last-modified: 2017-12-28T12:05:11Z
    source: RIPE

    % This query was served by the RIPE Database Query Service version 1.91.1 (HEREFORD)


    )\/(ark

    Always Mount a Scratch Monkey
    Do you manage your own servers? If you are not running an IDS/IPS yer doin' it wrong...
    ... I'm not as thunk as you drink I am.
    ---
    * Origin: (1:3634/12.73)
  • From Bill McGarrity@1:266/404 to mark lewis on Fri Apr 6 09:15:00 2018
    mark lewis wrote to Bill McGarrity on 04-06-18 00:53 <=-


    On 2018 Apr 04 21:19:30, Digital Man wrote to you:
    4/4 10:54:51p 1380 SSH connection accepted from: 185.222.209.108 port
    49347
    4/4 10:54:56p 1380 SSH active channel 'direct-tcpip' is not
    'session', disconnecting.
    4/4 10:54:56p 1380 SSH session establishment failed

    Someone is trying to use your SSH server as a proxy (port-forwarder), most likelyk to attack other hosts on the Internet.

    interestingly enough, we have 65 188.*.*.* entries in the perimeter
    block list managed by our IDS but none of them are 188.222.*.*...

    depending on the required information, you could maybe file a complaint with their abuse department...

    $ whois 185.222.209.108
    % This is the RIPE Database query service.
    % The objects are in RPSL format.
    %
    % The RIPE Database is subject to Terms and Conditions.
    % See http://www.ripe.net/db/support/db-terms-conditions.pdf

    Oh I have... :)

    I've written more emails concerning the crazies but namy of them are from South America and they seem to be behind the providers NAT wall. I was more concerned over the tcp message not sure what it meant. :)

    Thanks..


    --

    Bill

    Telnet: tequilamockingbirdonline.net
    Web: bbs.tequilamockingbirdonline.net
    FTP: ftp.tequilamockingbirdonline.net:2121
    IRC: irc.tequilamockingbirdonline.net Ports: 6661-6670 SSL: +6697
    Radio: radio.tequilamockingbirdonline.net:8010/live


    ... Look Twice... Save a Life!!! Motorcycles are Everywhere!!!
    --- MultiMail/Win32 v0.50
    * Origin: TequilaMockingbird Online - Toms River, NJ (1:266/404)