Liebe Mitdenker, liebe Wissende, liebe Neugierige,
ja!
Ich bin jetzt ein bisschen platt... Gehört Amazon jetzt auch zu den Eindringlingen, die fremde Server hacken?
2015-03-11 16:18:15,780 fail2ban.actions: WARNING [ssh] Ban 54.154.82.95
root@xxx:# whois 54.154.82.95
ARIN WHOIS data and services are subject to the Terms of Use
available at: https://www.arin.net/whois_tou.html
If you see inaccuracies in the results, please report at
http://www.arin.net/public/whoisinaccuracy/index.xhtml
The following results may also be obtained via:
http://whois.arin.net/rest/nets;q=54.154.82.95?showDetails=true&showARIN=false&ext=netref2
NetRange: 54.144.0.0 - 54.159.255.255 CIDR: 54.144.0.0/12 NetName: AMAZON NetHandle: NET-54-144-0-0-1 Parent: NET54 (NET-54-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Amazon Technologies Inc. (AT-88-Z) RegDate: 2014-10-23 Updated: 2014-11-13 Ref: http://whois.arin.net/rest/net/NET-54-144-0-0-1
OrgName: Amazon Technologies Inc. OrgId: AT-88-Z Address: 410 Terry Ave N. City: Seattle StateProv: WA PostalCode: 98109 Country: US RegDate: 2011-12-08 Updated: 2014-10-20 Comment: All abuse reports MUST include: Comment: * src IP Comment: * dest IP (your IP) Comment: * dest port Comment: * Accurate date/timestamp and timezone of activity Comment: * Intensity/frequency (short log extracts) Comment: * Your contact details (phone and email) Without these we will be unable to identify the correct owner of the IP address at that point in time. Ref: http://whois.arin.net/rest/org/AT-88-Z
OrgTechHandle: ANO24-ARIN OrgTechName: Amazon EC2 Network Operations OrgTechPhone: +1-206-266-4064 OrgTechEmail: aes-noc@amazon.com OrgTechRef: http://whois.arin.net/rest/poc/ANO24-ARIN
OrgAbuseHandle: AEA8-ARIN OrgAbuseName: Amazon EC2 Abuse OrgAbusePhone: +1-206-266-4064 OrgAbuseEmail: ec2-abuse@amazon.com OrgAbuseRef: http://whois.arin.net/rest/poc/AEA8-ARIN
OrgNOCHandle: AANO1-ARIN OrgNOCName: Amazon AWS Network Operations OrgNOCPhone: +1-206-266-2187 OrgNOCEmail: aes-noc@amazon.com OrgNOCRef: http://whois.arin.net/rest/poc/AANO1-ARIN
Ist das noch normal? Es muss mindestens drei Fehlversuche geben, damit fail2ban tätig wird - Standardeinstellung
Spirituelle Grüße Euer Robert
Möge der Forumsgeist wiederbelebt werden!