Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Cholera]

Hi!
I found some strange login attempts in my log:
my NAS is configured in the network as IP 192.168.1.102
Logins should come from this network range.


I found this:

Jul 18 22:03:37 NAS smbd: CIFS: Authentication for user [lars@scandimedia.de] has FAILED.
Jul 18 22:03:37 NAS smbd: CIFS: [162.244.81.175] connected to [Volume_1] as user [nobody].

Some others with different IPs, too:

Jul 18 15:44:46 NAS smbd: CIFS: Authentication for user [ERSAN] has FAILED.
Jul 18 15:44:49 NAS smbd: CIFS: [78.180.155.153] connected to [Volume_1] as user [nobody].
Jul 18 15:44:50 NAS smbd: CIFS: [78.180.155.153] connected to [Time_Machine] as user [nobody].

Neither do I know the usernames, nor the IPs.
how can They connect to my NAS?

Can I somehow disable the dlink connection, to prevent this?

[Cholera]

No one?
I still have new attempts in my log files...

[ivan]

Have you blocked access to 192.168.1.102 in your router or do you have port forwarding enabled to that IP.

If it is the latter then what you are seeing is the usual search for open devices on the net carried out by many people looking for such things as web-cams nas boxes and so on.  You would have the horrors if you saw the logs for our firewall and managed switch - if we get less than 300 attempts a day we think we are doing well.

Edit:
The 162.244.81.175 resolves to Adobe Media Server if that is any help.