The bots have arrived. :/ I'm now watching as my BBS gets taken over by telnet
connections, some try to use a username during the matrix menu, others just sit
there tieing up the line/node until the 60 second timeout that I imposed. Desp
ite this, I've got a real "squatter" problem to tend to, with two potential solu
tions - either change my BBS's telnet port off 23 and risk this happening again,
or run something like fail2ban to block these connections from repeating.
I've also configured pfSense to only allow 2 concurrent connections, with no mor
e than 5 burst sessions throttling back to 2. This did reduce the issue from ha
ppening many times a day to only a couple times a day, but it didn't knock it ou
t. That's where fail2ban comes into play.
The issue I'm encountering is that I have my log level set to Info, and yet I ha
ve not found an obvious way to determine "BBS got an incoming connection from IP
x.x.x.x". Combining that entry with a line in hack.log and/or hangup.log would
make this a breeze. Is there an option I haven't spotted that would either all
ow this to happen, or allow some kind of logging that fail2ban cuold trap on to
detect these kinds of attaacks?
-Winzlo
===
■ The Down-Lo BBS ■ bbs.winzlo.com
...A celebrity is a person who is known for his well-knownness.
--- SBBSecho 3.37-Linux
* Origin: The Down-Lo BBS * bbs.winzlo.com (1:154/140)
■ Synchronet ■ Vertrauen ■ Home of Synchronet ■ [vert/cvs/bbs].synchro.net
|
