Alarming syslogs

[Swistheater]

so i do not have any remote access settings turned on and yet i see this in system logs

httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 108.33.213.8 in login

why would this happen?

 

[Makaveli]

so i do not have any remote access settings turned on and yet i see this in system logs

httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 108.33.213.8 in login

why would this happen?

Interesting when I check that ip.

https://www.abuseipdb.com/check/108.33.213.8

 

[Swistheater]

Interesting when I check that ip.

https://www.abuseipdb.com/check/108.33.213.8

yes I ran this check, which has me quite alarmed. especially when you see other people reporting the same thing.

 

[Davidncali001]

yes I ran this check, which has me quite alarmed. especially when you see other people reporting the same thing.

I have this, saw it in the connections tab on my router and didn't really think to much of it. Just now after seeing your post, I ran Netstat -A -N -O and found this: https://www.abuseipdb.com/check/72.21.91.29

 

[dosborne]

Turn off your logs or stop looking at them. Problem solved.

J/K I haven't seen anything like that in mind, but I hope you guys figure out what is caúsing it.

 

[Centrifuge]

httpd_login_lock

Somebody trying to hack into your webgui?

 

[Treadler]

so i do not have any remote access settings turned on and yet i see this in system logs

httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 108.33.213.8 in login

why would this happen?

I think it’s a warning from Skynet, letting you know bad guys are sniffing around. Via SSH?

 

[gattaca]

^^^ Rogue players are scanning for any and all ways (ports/services) to penetrate anything listening which is connected to the public facing internet. These routers are our front door and lock! That's why I often double-nat them. Get thru one, well buddy, there's another and it's got a different set of creds and in some cases I even use a different manufacturer.

I am a surprised that the httpd (WebGUI) would even be listening on the public/WAN side of the router when that check box is turned OFF in the setup... RMerlin may have to answer that one. That's the real?

SSHing into the router is a totally different port and service NOT connected with httpd... I think sshd would be reporting kicks to that port...

Only testing or looking at the code can say for sure. Gut says having this value off in Admin > Other would mean httpd is not listening on the WAN side of the router. I am unsure what "Enable Access Restrictions" does. But maybe it is listening and reporting those port scans... which seem risker than not listening at all!! In other words, the router should should be just dropping all those packets and scans when set to No and operating in "stealth" mode.

You really don't want to give the bad guys a reason to come back to your door b/c they know you have a httpd processes listening. Most commercial FW might log the scans but drop any and all responses.

 

[L&LD]

so i do not have any remote access settings turned on and yet i see this in system logs

httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 108.33.213.8 in login

why would this happen?

Do I have to ask when was the last time a full reset to factory defaults was performed?

 

[RMerlin]

I am a surprised that the httpd (WebGUI) would even be listening on the public/WAN side of the router when that check box is turned OFF in the setup... RMerlin may have to answer that one. That's the real?

No, it doesn't.

admin@stargate88ax:/tmp/home/root# netstat -tpln | grep http
tcp        0      0 127.0.0.1:80            0.0.0.0:*               LISTEN      1104/httpd
tcp        0      0 192.168.10.1:80         0.0.0.0:*               LISTEN      1104/httpd
tcp        0      0 127.0.0.1:8443          0.0.0.0:*               LISTEN      1103/httpds
tcp        0      0 192.168.10.1:8443       0.0.0.0:*               LISTEN      1103/httpds

 

[Swistheater]

Do I have to ask when was the last time a full reset to factory defaults was performed?

about a week ago with settings put in properly.- I think this issue was caused by security cameras. I had a brief wan down event and i am sure the router tried to redirect all connections to router.asus.com and this most likely caused this issue, because the camera system connects through verizon as a cellular backup.

 

[Swistheater]

No, it doesn't.

admin@stargate88ax:/tmp/home/root# netstat -tpln | grep http
tcp        0      0 127.0.0.1:80            0.0.0.0:*               LISTEN      1104/httpd
tcp        0      0 192.168.10.1:80         0.0.0.0:*               LISTEN      1104/httpd
tcp        0      0 127.0.0.1:8443          0.0.0.0:*               LISTEN      1103/httpds
tcp        0      0 192.168.10.1:8443       0.0.0.0:*               LISTEN      1103/httpds

yea and mine looks exactly like this. but mine is 192.168.1.1.

 

[Swistheater]

^^^ Rogue players are scanning for any and all ways (ports/services) to penetrate anything listening which is connected to the public facing internet. These routers are our front door and lock! That's why I often double-nat them. Get thru one, well buddy, there's another and it's got a different set of creds and in some cases I even use a different manufacturer.

I am a surprised that the httpd (WebGUI) would even be listening on the public/WAN side of the router when that check box is turned OFF in the setup... RMerlin may have to answer that one. That's the real?

SSHing into the router is a totally different port and service NOT connected with httpd... I think sshd would be reporting kicks to that port...

Only testing or looking at the code can say for sure. Gut says having this value off in Admin > Other would mean httpd is not listening on the WAN side of the router. I am unsure what "Enable Access Restrictions" does. But maybe it is listening and reporting those port scans... which seem risker than not listening at all!! In other words, the router should should be just dropping all those packets and scans when set to No and operating in "stealth" mode.

You really don't want to give the bad guys a reason to come back to your door b/c they know you have a httpd processes listening. Most commercial FW might log the scans but drop any and all responses.

View attachment 18090

yea this setting is disabled for me- and ssh can only be accessed lan side.

 

[thelonelycoder]

I think it’s a warning from Skynet, letting you know bad guys are sniffing around. Via SSH?

Not Skynet but the firmware built in protection mechanism.

 

[gattaca]

^^^ So something IS listening on whatever port you have for httpd (80/443/8443...) and reporting someone is ringing the doorbell. Hmm.. IDK.