btmp show server being attacked

[tony j. podrasky]

I did a <last> and <lastb> on my system and found someone trying to hack into it. Here are a few entries:

zabbix ssh:notty 155.94.169.167 Tue Sep 25 17:14 - 17:14 (00:00)

www-data ssh:notty 155.94.169.167 Tue Sep 25 17:13 - 17:13 (00:00)

vmail ssh:notty 155.94.169.167 Tue Sep 25 17:08 - 17:08 (00:00)

Does anyone know what port they are using to try to get into my system?

Does anyone know what to edit to keep they from connecting/getting any kind of session?

[avd437 · Accepted solution]

What is os version ?

You can do os hardening, use CIS starndards

https://www.cisecurity.org/cis-benchmarks/

[tony j. podrasky]

Running Fedora 16.

Thanks for the URL. I'll check into it.

regards,

tony