[KFUG] samba를 띄워두면 집중 공격을 받네요...

[rataplan <rataplan@xxxxxxxxxx>]

제가 삼바를 띄워두고 stop을 시켜놓지 않았습니다. 오늘 우연히
/var/log/message로그가
몇일간격으로 계속 생겨난게 의심스러워 확인해보니... 대략 4-5일전부터 IP
가 변경되면서..
굉장히 많은 IP 대역에서 접속을 시도했네요...

몇개 IP를 확인해보니... 모두 국내 사용자이더군요...
그런데, IP가 하나가 아니라 굉장히 다양하게 접근을 시도하려했는데...
도무지 이해가 가질 않네요...

제가 개인적으로 운영하는 서버라서 그다지 알려지지도 않았을텐데...
어떻게 이렇게 다양한 IP로 접근을 시도했는지...

해킹툴을 이용했다해도... 잘 이해가 되질 않고요...
설명좀 부탁드릴게요...

아래는 아주 일부분의 로그를 붙였습니다.


Dec 11 20:56:57 rataplan smbd[11729]: [2004/12/11 20:56:57, 0]
lib/access.c:check_access(333)
Dec 11 20:56:57 rataplan smbd[11729]: Denied connection from (211.218.3.152)
Dec 11 20:56:57 rataplan smbd[11731]: [2004/12/11 20:56:57, 0]
lib/access.c:check_access(333)
Dec 11 20:56:57 rataplan smbd[11731]: Denied connection from (211.218.3.152)
Dec 11 20:56:57 rataplan smbd[11730]: [2004/12/11 20:56:57, 0]
lib/access.c:check_access(333)
Dec 11 20:56:57 rataplan smbd[11730]: Denied connection from (211.218.3.152)
Dec 11 20:56:57 rataplan smbd[11732]: [2004/12/11 20:56:57, 0]
lib/access.c:check_access(333)
Dec 11 20:56:57 rataplan smbd[11733]: [2004/12/11 20:56:57, 0]
lib/access.c:check_access(333)
Dec 11 20:56:57 rataplan smbd[11733]: Denied connection from (211.218.3.152)
Dec 11 20:56:57 rataplan smbd[11732]: Denied connection from (211.218.3.152)
Dec 11 21:00:44 rataplan smbd[11763]: [2004/12/11 21:00:44, 0]
lib/access.c:check_access(333)
Dec 11 21:00:44 rataplan smbd[11763]: Denied connection from
(211.218.249.141)
Dec 11 21:08:37 rataplan smbd[11774]: [2004/12/11 21:08:37, 0]
lib/access.c:check_access(333)
Dec 11 21:08:37 rataplan smbd[11774]: Denied connection from (211.218.2.237)
Dec 11 21:08:37 rataplan smbd[11775]: [2004/12/11 21:08:37, 0]
lib/access.c:check_access(333)
Dec 11 21:08:37 rataplan smbd[11775]: Denied connection from (211.218.2.237)
Dec 11 21:08:37 rataplan smbd[11776]: [2004/12/11 21:08:37, 0]
lib/access.c:check_access(333)
Dec 11 21:08:37 rataplan smbd[11776]: Denied connection from (211.218.2.237)
Dec 11 21:51:39 rataplan smbd[11911]: [2004/12/11 21:51:39, 0]
lib/access.c:check_access(333)
Dec 11 21:51:39 rataplan smbd[11911]: Denied connection from
(211.249.123.74)
Dec 11 21:52:48 rataplan smbd[11912]: [2004/12/11 21:52:48, 0]
lib/access.c:check_access(333)
Dec 11 21:52:48 rataplan smbd[11912]: Denied connection from
(211.249.123.74)
Dec 11 21:53:24 rataplan smbd[11913]: [2004/12/11 21:53:24, 0]
lib/access.c:check_access(333)
Dec 11 21:53:24 rataplan smbd[11913]: Denied connection from
(211.249.123.74)
Dec 11 22:58:45 rataplan smbd[12345]: [2004/12/11 22:58:45, 0]
lib/access.c:check_access(333)
Dec 11 22:58:45 rataplan smbd[12345]: Denied connection from
(211.218.223.69)
Dec 11 22:58:46 rataplan smbd[12346]: [2004/12/11 22:58:46, 0]
lib/access.c:check_access(333)
Dec 11 22:58:46 rataplan smbd[12346]: Denied connection from
(211.218.223.69)
Dec 11 23:53:42 rataplan smbd[12520]: [2004/12/11 23:53:42, 0]
lib/access.c:check_access(333)
Dec 11 23:53:42 rataplan smbd[12520]: Denied connection from
(211.222.227.164)
Dec 11 23:53:42 rataplan smbd[12521]: [2004/12/11 23:53:42, 0]
lib/access.c:check_access(333)
Dec 11 23:53:42 rataplan smbd[12521]: Denied connection from
(211.222.227.164)
Dec 12 00:03:18 rataplan smbd[12595]: [2004/12/12 00:03:18, 0]
lib/access.c:check_access(333)

_______________________________________________
한국 FreeBSD 사용자 그룹(KFUG) questions 메일링 리스트
questions at kr.FreeBSD.org
http://www.kr.FreeBSD.org/mailman/listinfo/questions