I just did a 'netstat -a' on my FreeBSD machine. I discovered the following:
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 40 turban.ssh host90.embarqser.60230 ESTABLISHED
tcp4 0 0 turban.ssh host90.embarqser.59985 LAST_ACK
tcp4 0 0 turban.ssh host90.embarqser.47224 TIME_WAIT
tcp4 0 0 turban.ssh host90.embarqser.9304 LAST_ACK
Could there be someone intruding my machine? My hostname is 'turban' as you can see. I'm really 'new' about system security. Could someone enlighten me?
From /var/log/auth.log
, a lot of errors like:
May 4 20:07:10 turban sshd[47801]: Failed keyboard-interactive/pam for invalid user backup from 76.7.43.90 port 11831 ssh2
May 4 20:07:13 turban sshd[47804]: error: PAM: authentication error for bin from 76.7.43.90...
netstat -an
is better, gives IP addresses instead of names. – nik May 4 '11 at 12:30