Hi,
I get the following on my Microtik router os.
Looks like someone is trying to log into my system.
Is there a way of blocking the IP thats trying to access or any better solution.
Thanks
echo: system,error,critical login failure for user ftp from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user test from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user root from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user admin from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user guest from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user master from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user apache from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user root from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user root from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user root from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user root from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user root from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user admin from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user admin from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user admin from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user admin from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user root from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user root from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user test from 67.225.209.238 via ssh
[admin@Sumo] >
echo: system,error,critical login failure for user test from 67.225.209.238 via ssh
the best solution is to change your ssh port from 22 to something else.
the best solution is to use the security scripts on the wiki.
http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention_(FTP_%26_SSH)
http://wiki.mikrotik.com/wiki/Firewall
There are a lot of mentions of this in the forum.