SMB? Finger? A Windows box with the same users? Is this a mail server? Does your mail server support the VRFY method? This could have allowed random user enumeration. There are vulnerabilities in certain Apache configurations that allow for user enumeration as well; when you go to domain.com/~realuser you get a 'permission deined' message, and domain.com/~fakeuser you get 'directory not accessible' or something. What is the box used for? Have you ever run nmap on it from outside? > -----Original Message----- > From: tclug-list-bounces at mn-linux.org > [mailto:tclug-list-bounces at mn-linux.org] On Behalf Of Pastor > Doug Coats > Sent: Thursday, March 04, 2004 8:55 AM > To: TCLUG Mailing List > Subject: [TCLUG] Attack > > > I am running Fedora Core1 and had an interesting attack show > up in my logs. > > Someone tried to ssh running through the entire list of users. > > My question is how did they get that list of valid users? > There is no evidence of simply trying random users - they > knew every user. > > Is there something in Linux that would return a request for > every user name? > > Is there something I should have turned off so that cannot > happen again? > > I blocked their IP address in IPTables but they can find a > way around that. And I would like to block anyone from trying > something similar. > > Any suggestions would be greatly appreciated. > > Thanks All, > > Doug > > > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list