Virtual Router/ Firewall/ VPN

Reply
Occasional Contributor
Posts: 9
Registered: ‎06-13-2016

https listen for webserver opening ssh sessions for Malicious IP

Hi Experts ,

   There is some serious threat or issue if u turned on set service listen-address x.x.x.x for Web Gui or web server for management or configs of vyatta , then number of attackers or malicious ip establised ssh connection to your vyatta v5400 as well as v5600 , any thought or idea.

 

Trying to understand how opening https for API or web gui causing ssh session even we have ssh username and password commands set .

 

 

vyatta~$ show system connections | grep ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34802 ESTABLISHED
tcp 0 0 127.0.0.1:34796 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34792 ESTABLISHED
tcp 0 0 127.0.0.1:34799 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34795 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34799 ESTABLISHED
tcp 0 0 168.1.X.X:22 191.96.249.38:38846 ESTABLISHED
tcp 0 0 127.0.0.1:34792 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34801 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34793 ESTABLISHED
tcp 0 0 127.0.0.1:34793 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34801 ESTABLISHED
tcp 0 0 168.1.X.X:22 58.218.198.142:62307 ESTABLISHED----->from china (58.218.198.142)
tcp 0 0 127.0.0.1:199 127.0.0.1:34795 ESTABLISHED
tcp 0 0 127.0.0.1:34802 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34796 ESTABLISHED
tcp 0 68 168.1.114.92:22 58.218.198.142:57032 ESTABLISHED
vyatta@gw-melbourne1-02-06-2016:~$
vyatta@gw-melbourne1-02-06-2016:~$
vyatta@gw-melbourne1-02-06-2016:~$ show system connections | grep ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34802 ESTABLISHED
tcp 0 0 127.0.0.1:34796 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34792 ESTABLISHED
tcp 0 0 127.0.0.1:34799 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34795 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34799 ESTABLISHED
tcp 0 0 127.0.0.1:34792 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34801 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34793 ESTABLISHED
tcp 0 0 127.0.0.1:34793 127.0.0.1:199 ESTABLISHED
tcp 0 720 168.1.X.X:22 191.96.249.38:53234 ESTABLISHED----> from Russia (191.96.249.38)
tcp 0 0 127.0.0.1:199 127.0.0.1:34801 ESTABLISHED
tcp 0 52 168.1.X.X:22 216.85.5.86:54368 ESTABLISHED --->legitimate connection 
tcp 0 0 127.0.0.1:199 127.0.0.1:34795 ESTABLISHED
tcp 0 0 127.0.0.1:34802 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34796 ESTABLISHED


vyatta:~$ show configuration commands | grep http
set service https listen-address '10.118.125.97'
vyatta@:~$ configure
[edit]
vyatta@# delete service https listen-address  ---->After deleting or disabling https listen address no ssh session from Malicious IP .


[edit]
vyatta@# commi
commit commit-confirm
[edit]
vyatta@# commit
[ service https ]
Stopping web server: lighttpd.
Starting web server: lighttpd.
Stopping API PAGER server
Starting API PAGER server
spawn-fcgi: child spawned successfully: PID: 25607

[edit]
vyatta@# show system connections | grep ESTABLISHED

Configuration path: system [connections] is not valid
Show failed

[edit]
vyatta@# exit
Warning: configuration changes have not been saved.
exit
vyatta@:~$ show system connections | grep ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34802 ESTABLISHED
tcp 0 0 127.0.0.1:34796 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34792 ESTABLISHED
tcp 0 0 127.0.0.1:34799 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34795 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34799 ESTABLISHED
tcp 0 0 127.0.0.1:34792 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34801 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34793 ESTABLISHED
tcp 0 0 127.0.0.1:34793 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34801 ESTABLISHED
tcp 0 52 168.1.X.X:22 216.85.5.86:54368 ESTABLISHED --->legitimate connection 
tcp 0 0 127.0.0.1:199 127.0.0.1:34795 ESTABLISHED
tcp 0 0 127.0.0.1:34802 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34796 ESTABLISHED
vyatta@:~$ show system connections | grep ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34802 ESTABLISHED
tcp 0 0 127.0.0.1:34796 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34792 ESTABLISHED
tcp 0 0 127.0.0.1:34799 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34795 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34799 ESTABLISHED
tcp 0 0 127.0.0.1:34792 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34801 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34793 ESTABLISHED
tcp 0 0 127.0.0.1:34793 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34801 ESTABLISHED
tcp 0 52 168.1.X.X:22 216.85.5.86:54368 ESTABLISHED --->legitimate connection 
tcp 0 0 127.0.0.1:199 127.0.0.1:34795 ESTABLISHED
tcp 0 0 127.0.0.1:34802 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34796 ESTABLISHED
vyatta@:~$ show system connections | grep ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34802 ESTABLISHED
tcp 0 0 127.0.0.1:34796 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34792 ESTABLISHED
tcp 0 0 127.0.0.1:34799 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34795 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34799 ESTABLISHED
tcp 0 0 127.0.0.1:34792 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:34801 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34793 ESTABLISHED
tcp 0 0 127.0.0.1:34793 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34801 ESTABLISHED
tcp 0 52 168.1.X.X:22 216.85.5.86:54368 ESTABLISHED --->legitimate connection 
tcp 0 0 127.0.0.1:199 127.0.0.1:34795 ESTABLISHED
tcp 0 0 127.0.0.1:34802 127.0.0.1:199 ESTABLISHED
tcp 0 0 127.0.0.1:199 127.0.0.1:34796 ESTABLISHED

Join the Community

Get quick and easy access to valuable resource designed to help you manage your Brocade Network.

vADC is now Pulse Secure
Download FREE NVMe eBook