OneTwenty web services were temporarily down earlier today, possibly due to an attempted hack. The kernel caught a TCP window shrink attempt:<\/p>\n
TCP: Treason uncloaked! Peer 220.128.54.50:2072\/80 shrinks window<\/p><\/blockquote>\n
This page<\/a> has a few explainations of what the problem could be. The http site at the IP address in question<\/a> looks to be a vanilla Mandrake install. Running a reverse DNS lookup<\/a> reveals that the computer is somewhere in China (that is, if it isn’t a masqueraded IP).<\/p>\n
Anyhow, the kernel caught the problem and I used iptables<\/a> to automatically drop packets originating from that IP address. Anyone else have something like this happen recently?<\/p>\n
Update<\/strong>: Installed OSSEC<\/a> per Steve<\/a>‘s suggestion. The latest version (0.9.3) installs easily (following the instructions in the manual<\/a>) and even creates the \/etc\/init.d\/ossec file for easy use in Ubuntu<\/a>!<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"
OneTwenty web services were temporarily down earlier today, possibly due to an attempted hack. The kernel caught a TCP window shrink attempt: TCP: Treason uncloaked! Peer 220.128.54.50:2072\/80 shrinks window This page has a few explainations of what the problem could be. The http site at the IP address in question looks to be a vanilla … Continue reading “OneTwenty web services temporarily down (attempted hack?)”<\/span><\/a><\/p>\n","protected":false},"author":67,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[1],"tags":[],"jetpack_featured_media_url":"","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paLsRH-3e","_links":{"self":[{"href":"https:\/\/nick.onetwenty.org\/index.php\/wp-json\/wp\/v2\/posts\/200"}],"collection":[{"href":"https:\/\/nick.onetwenty.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nick.onetwenty.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nick.onetwenty.org\/index.php\/wp-json\/wp\/v2\/users\/67"}],"replies":[{"embeddable":true,"href":"https:\/\/nick.onetwenty.org\/index.php\/wp-json\/wp\/v2\/comments?post=200"}],"version-history":[{"count":0,"href":"https:\/\/nick.onetwenty.org\/index.php\/wp-json\/wp\/v2\/posts\/200\/revisions"}],"wp:attachment":[{"href":"https:\/\/nick.onetwenty.org\/index.php\/wp-json\/wp\/v2\/media?parent=200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nick.onetwenty.org\/index.php\/wp-json\/wp\/v2\/categories?post=200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nick.onetwenty.org\/index.php\/wp-json\/wp\/v2\/tags?post=200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}