mieki256's diary

/var/log/message には以下のようなログが。

Nov 27 06:04:20 XXXXXX inetd[1810]: pop-3/tcp server failing (looping or being flooded), service terminated for 10 min
Nov 27 06:31:24 XXXXXX inetd[1810]: pop-3/tcp server failing (looping or being flooded), service terminated for 10 min

/var/log/maillog には以下のようなログ。

Nov 27 05:55:43 XXXXXX in.qpopper[31377]: (v4.0.9) Servicing request from "65-68-51-61.ded.swbell.net" at 65.68.51.61
Nov 27 05:56:30 XXXXXX in.qpopper[31388]: (v4.0.9) Servicing request from "65-68-51-61.ded.swbell.net" at 65.68.51.61
Nov 27 05:56:41 XXXXXX in.qpopper[31388]: support at 65-68-51-61.ded.swbell.net (65.68.51.61): -ERR [AUTH] Password supplied for "support" is incorrect.
Nov 27 05:56:41 XXXXXX in.qpopper[31393]: (v4.0.9) Servicing request from "65-68-51-61.ded.swbell.net" at 65.68.51.61
Nov 27 05:56:52 XXXXXX in.qpopper[31393]: support at 65-68-51-61.ded.swbell.net (65.68.51.61): -ERR [AUTH] Password supplied for "support" is incorrect.
Nov 27 05:56:52 XXXXXX in.qpopper[31398]: (v4.0.9) Servicing request from "65-68-51-61.ded.swbell.net" at 65.68.51.61
Nov 27 05:57:03 XXXXXX in.qpopper[31398]: support at 65-68-51-61.ded.swbell.net (65.68.51.61): -ERR [AUTH] Password supplied for "support" is incorrect.
Nov 27 05:57:03 XXXXXX in.qpopper[31402]: (v4.0.9) Servicing request from "65-68-51-61.ded.swbell.net" at 65.68.51.61
Nov 27 05:57:14 XXXXXX in.qpopper[31402]: support at 65-68-51-61.ded.swbell.net (65.68.51.61): -ERR [AUTH] Password supplied for "support" is incorrect.
Nov 27 05:57:14 XXXXXX in.qpopper[31405]: (v4.0.9) Servicing request from "65-68-51-61.ded.swbell.net" at 65.68.51.61
Nov 27 05:57:25 XXXXXX in.qpopper[31405]: support at 65-68-51-61.ded.swbell.net (65.68.51.61): -ERR [AUTH] Password supplied for "support" is incorrect.
Nov 27 05:57:25 XXXXXX in.qpopper[31410]: (v4.0.9) Servicing request from "65-68-51-61.ded.swbell.net" at 65.68.51.61

他にも色んなユーザ名でアクセスしてきてる。たぶん辞書攻撃なんだろう…。

inetd は、特定のサービスに対する大量のアクセスを受けると10分間停止してしまう。その間各サービスは使えず。大迷惑。

とりあえず、/etc/hosts.deny と /etc/hosts.allow を見直し。外部からもアクセスできるようにしてあったけど、この際だからLAN内からのみ利用できるように。