Greetings,
While doing one last check before upgrading to v7, I noticed that I cannot connect to my Gateway via the web connection. I get to the screen, "Socket was disconnected" - "Waiting for socket connection", and it just never seems to connect.
I logged in via ssh and decided to look at the length of the logfiles. (Note that the locations all change with version 7.)
Here is what I found.
------------------------------------------------------------
pi@raspberrypi ~/moteino $ tail -f gate-bash: cannot create temp file for here-document: No space left on device
pwd
tail: cannot open `gatepwd' for reading: No such file or directory
pi@raspberrypi ~/moteino $ df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 3023728 2885060 0 100% /
devtmpfs 218252 4 218248 1% /dev
none 44508 264 44244 1% /run
none 5120 0 5120 0% /run/lock
none 222524 0 222524 0% /run/shm
none 102400 0 102400 0% /run/user
/dev/mmcblk0p1 57288 20144 37144 36% /boot
pi@raspberrypi ~/moteino $[/font]
--------------------------------------------------------------
pi@raspberrypi /var $ uptime
10:31:41 up 47 days, 17:53, 1 user, load average: 1.01, 1.07, 1.07
pi@raspberrypi /var $ ls -l ~/moteino/gateway.sys.log
-rw-r--r-- 1 root root 43759550 Jan 3 10:31 /home/pi/moteino/gateway.sys.log
pi@raspberrypi /var $ ls -l /var/log/authlog
ls: cannot access /var/log/authlog: No such file or directory
pi@raspberrypi /var $ ls -l /var/log/auth*
-rw-r----- 1 root adm 436387 Jan 3 10:32 /var/log/auth.log
-rw-r----- 1 root adm 17788763 Jan 3 06:25 /var/log/auth.log.1
-rw-r----- 1 root adm 457960 Dec 27 06:25 /var/log/auth.log.2.gz
-rw-r----- 1 root adm 5546 Dec 20 06:25 /var/log/auth.log.3.gz
-rw-r----- 1 root adm 5570 Dec 13 06:25 /var/log/auth.log.4.gz
pi@raspberrypi /var $ ls -l /var/log/nginx
total 3272
-rw-r--r-- 1 root root 2686976 Jan 3 10:33 default.access.log
-rw-r--r-- 1 root root 655360 Jan 3 10:33 default.error.log
-rw-r--r-- 1 root root 0 May 12 2015 error.log
------------------------------------------------------------------
pi@raspberrypi /var $ tail -f /var/log/nginx/default.error.log
2015/12/22 11:45:24 [error] 1310#0: *8607 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:25 [error] 1310#0: *8608 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:27 [error] 1310#0: *8609 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:28 [error] 1310#0: *8610 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:30 [error] 1310#0: *8611 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:31 [error] 1310#0: *8612 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:32 [error] 1310#0: *8613 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:34 [error] 1310#0: *8614 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:35 [error] 1310#0: *8615 user "Admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:38 [error] 1310#0: *8616 user "Admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "50.190.6
------------------------------------------------------------
[/font]
Looking back through the records, I see that within a week of putting my PI online, the cracking attempts have started. 196 attempts in 46 seconds, for the first cracker blizzard.
I can only assume that the assault will continue ad infinitum. While I don't 'need' logs of those attempts, I don't think it's a good idea to send them to /dev/null either.
I wonder if anyone else out there has this problem, and the best way to manage it. Expiring/rotating the logs? Implementing an IP-addr blacklist?
Just for completeness' sake, I include the list of attempted logins (and # attempts) for that first 46 second attack.
Attempted User # attempts
"admin" 142
"Admin" 2
"adsl" 2
"cisco" 2
"Cisco" 2
"enable" 2
"kyivstar" 2
"mgts" 2
"mts" 2
"osteam" 2
"pnadmin" 2
"root" 14
"super" 4
"superadmin" 2
"support" 4
"telecomadmin" 2
"telekom" 2
"user" 4
"ZXDSL" 2
-Chris
Quote from: thalx on January 03, 2016, 11:08:10 AM
Greetings,
While doing one last check before upgrading to v7, I noticed that I cannot connect to my Gateway via the web connection. I get to the screen, "Socket was disconnected" - "Waiting for socket connection", and it just never seems to connect.
I logged in via ssh and decided to look at the length of the logfiles. (Note that the locations all change with version 7.)
Here is what I found.
------------------------------------------------------------
pi@raspberrypi ~/moteino $ tail -f gate-bash: cannot create temp file for here-document: No space left on device
pwd
tail: cannot open `gatepwd' for reading: No such file or directory
pi@raspberrypi ~/moteino $ df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 3023728 2885060 0 100% /
devtmpfs 218252 4 218248 1% /dev
none 44508 264 44244 1% /run
none 5120 0 5120 0% /run/lock
none 222524 0 222524 0% /run/shm
none 102400 0 102400 0% /run/user
/dev/mmcblk0p1 57288 20144 37144 36% /boot
pi@raspberrypi ~/moteino $[/font]
--------------------------------------------------------------
pi@raspberrypi /var $ uptime
10:31:41 up 47 days, 17:53, 1 user, load average: 1.01, 1.07, 1.07
pi@raspberrypi /var $ ls -l ~/moteino/gateway.sys.log
-rw-r--r-- 1 root root 43759550 Jan 3 10:31 /home/pi/moteino/gateway.sys.log
pi@raspberrypi /var $ ls -l /var/log/authlog
ls: cannot access /var/log/authlog: No such file or directory
pi@raspberrypi /var $ ls -l /var/log/auth*
-rw-r----- 1 root adm 436387 Jan 3 10:32 /var/log/auth.log
-rw-r----- 1 root adm 17788763 Jan 3 06:25 /var/log/auth.log.1
-rw-r----- 1 root adm 457960 Dec 27 06:25 /var/log/auth.log.2.gz
-rw-r----- 1 root adm 5546 Dec 20 06:25 /var/log/auth.log.3.gz
-rw-r----- 1 root adm 5570 Dec 13 06:25 /var/log/auth.log.4.gz
pi@raspberrypi /var $ ls -l /var/log/nginx
total 3272
-rw-r--r-- 1 root root 2686976 Jan 3 10:33 default.access.log
-rw-r--r-- 1 root root 655360 Jan 3 10:33 default.error.log
-rw-r--r-- 1 root root 0 May 12 2015 error.log
------------------------------------------------------------------
pi@raspberrypi /var $ tail -f /var/log/nginx/default.error.log
2015/12/22 11:45:24 [error] 1310#0: *8607 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:25 [error] 1310#0: *8608 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:27 [error] 1310#0: *8609 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:28 [error] 1310#0: *8610 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:30 [error] 1310#0: *8611 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:31 [error] 1310#0: *8612 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:32 [error] 1310#0: *8613 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:34 [error] 1310#0: *8614 user "admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:35 [error] 1310#0: *8615 user "Admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "www.xxx.yyy.zzz", referrer: "http://www.xxx.yyy.zzz/"
2015/12/22 11:45:38 [error] 1310#0: *8616 user "Admin" was not found in "/var/www/default/.htpasswd", client: 50.173.3.165, server: default, request: "GET / HTTP/1.1", host: "50.190.6
------------------------------------------------------------
[/font]
Looking back through the records, I see that within a week of putting my PI online, the cracking attempts have started. 196 attempts in 46 seconds, for the first cracker blizzard.
I can only assume that the assault will continue ad infinitum. While I don't 'need' logs of those attempts, I don't think it's a good idea to send them to /dev/null either.
I wonder if anyone else out there has this problem, and the best way to manage it. Expiring/rotating the logs? Implementing an IP-addr blacklist?
Just for completeness' sake, I include the list of attempted logins (and # attempts) for that first 46 second attack.
Attempted User # attempts
"admin" 142
"Admin" 2
"adsl" 2
"cisco" 2
"Cisco" 2
"enable" 2
"kyivstar" 2
"mgts" 2
"mts" 2
"osteam" 2
"pnadmin" 2
"root" 14
"super" 4
"superadmin" 2
"support" 4
"telecomadmin" 2
"telekom" 2
"user" 4
"ZXDSL" 2
-Chris
I would start by changing the external TCP port that you use to connect to your web server. Use a port that doesn't belong to another well-known application. Script kiddies using these types of attacks typically focus on the well-known web server ports. Simply picking something unusual will give you a greater level of obscurity.
I've seen some attacks on my own pi as well. Nginx will handle them and my pi never went down and I stopped trying to track them. This is unavoidable on any webserver that runs on well known ports.
I think syrinxtech's suggestion is what I would endorse, changing ports is probably the first thing I would do to obscure where the webserver lives.