help - under attack

[Matthias Apitz]

El día domingo, octubre 01, 2017 a las 11:18:14a. m. -0400, Ernie Luzar escribió:

> Hello list;
> 
> Installed 11.1 from scratch and after about 2-3 weeks I finally got 
> around to inspecting the /var/logs. I have never seen the auth.log file 
> roll over before, so this peaked my interest. It was full of failed 
> login attempts. My firewall blocks all inbound traffic, so I am very 
> baffled be what I see in the log. Any suggestions on how this can be 
> happening?
> 
> Sep 29 03:09:14 fbsd sshd[33675]: Connection closed by 149.202.179.216 
> port 48876 [preauth]
> ...

If you have a firewall (about which you have not said anything), how can
SYN-SYN-ACK happen on port 22?

	matthias
-- 
Matthias Apitz, ✉ guru at unixarea.de, ⌂ http://www.unixarea.de/  ☎ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub
8. Mai 1945: Wer nicht feiert hat den Krieg verloren.
8 de mayo de 1945: Quien no festeja perdió la Guerra.
May 8, 1945: Who does not celebrate lost the War.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20171001/fef40dfa/attachment.sig>