Question about IP block

[riprowan]

Lately I've been getting a lot of blocked IPs.

I'm curious which services are being used. I might turn off the service being probed (ie. FTP) if I knew which one it was.

[mike42dk]

Hi

Mostly it's portscan, for the most common ports, like FTP, SHH, TelNet, ports that perhaps can be hacked and used to get control over the server.

Just don't enable services you don't use, and as you have done set up IP ban

[jonny72]

I noticed some hacking attempts in the connection log and turned on Auto Block. Whilst this appears to be working perfectly, it has blocked quite a few IP's already, there is now no logging whatsoever anywhere - no trace of the logon attempts in the connection log. This would be useful so I could see why the auto blocking was activated.

Am I missing something, or is the logging turned off when Auto Block is turned on?

[riprowan]

Just don't enable services you don't use, and as you have done set up IP ban

* BUMP *

Shouldn't the log file include
- username attempting login
- service attempted to use

If the same username is being probed, or if the same service is being probed, then it seems the admin could take better informed action to prevent possible attacks.

Maybe I seem paranoid, but if you had been through what I've been through, you'd be paranoid too.

[mike42dk]

Hi

The username that has been tried to use at login is there in the systemlog.

But what port that the user had tried to use is missing, and that could be interesting to have in log!!

[Betard]

I have a similar thread started in the "DiskStation Manager 4.0 BETA" section http://forum.synology.com/enu/viewtopic.php?f=189&t=46787

In regards to notifications I noticed that you can define the message.

Dear user,

IP address [%CLIENT_IP%] of %HOSTNAME% had %AUTOBLOCK_ATTEMPTS% failed login attempts within %AUTOBLOCK_ATTEMPT_MIN% minutes, and has been blocked at %AUTOBLOCK_TIME%.

Sincerely,
%COMPANY_NAME%

I have been searching, but unable to find a list of the available %% variables. Perhaps there is one for username, port or service? If so, that would certainly help those of us looking for "more" information.