I just did a 'netstat -a' on my FreeBSD machine. I discovered the following:
Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp4 0 40 turban.ssh host90.embarqser.60230 ESTABLISHED tcp4 0 0 turban.ssh host90.embarqser.59985 LAST_ACK tcp4 0 0 turban.ssh host90.embarqser.47224 TIME_WAIT tcp4 0 0 turban.ssh host90.embarqser.9304 LAST_ACK
Could there be someone intruding my machine? My hostname is 'turban' as you can see. I'm really 'new' about system security. Could someone enlighten me?
/var/log/auth.log, a lot of errors like:
May 4 20:07:10 turban sshd: Failed keyboard-interactive/pam for invalid user backup from 18.104.22.168 port 11831 ssh2
May 4 20:07:13 turban sshd: error: PAM: authentication error for bin from 22.214.171.124...