I just came back from full blown forensics mode. Conclusion: everything OK, this was just caused by multiple levels of (third party) stupid.pic.twitter.com/C2kjhAs2I4
-
Yes, that's an RFC1918 IP (not in a range I use (!)) logging in to a server as root, with password. And there was no wtmp entry or history.
Conclusion: the people nominally managing this server (who still use passwords) SFTPed in from the *same* ISP and they fail at CgNAT.
-
-
Apparently they're using RFC1918 space for CgNAT (which is stupid, they should use RFC6598) and it leaks into their colo servers sans NAT.
-
Remember that all IPv4 address space is routable. RFC 1918 is usually not routed. (127/8 is debatable.)
- Show replies
New conversation -
-
-
Nice find. :-)
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.