Re: [cobalt-users] SSH EXPLOIT IN THE WILD

["Mark S Burgunder" <maillist-raq@xxxxxxxxxx>]

On 9/16/03 2:42 PM, "Paul Warner" wrote:

> SSHD : 68.47.255.231, 216.40.243.26 : spawn (/bin/echo -e "logs\: \n TCP
> Wrappers\: Connection Alert\nBy\:            $(uname -n)\ndate\:
> $(date)\nhostip\:                %a\nhostname\:      %h\nprocess\:
> %d
> (pid %p)\nconnectfrom\:   %c\nsource\:        %h %H\nport\:
> %d\n"|
> /bin/mail -s "Wrappers@$(uname -n)\: %d Connection Alert %c" root ) &
>
> Does that make me paranoid?

This is great. I have put it in my hosts.allow file as well.
I have played around a bit with the IP addresses and read he man pages for
hosts.allow but could not figure out how I would change the above 'line'
so that it always get's executed, no matter what ip address the SSH
connection originates from.

Has anyone an idea what I should put in the ip-address spot to avtivate
this rule always?

Cheers
Mark S Burgunder