A month has past since I made a change to my Wordpress templates to experiment with Google bot (see previous post) and I can proudly report that it works like a charm.

My original problem was that Google was returning search results pointing to index-style pages on my Blog instead of the post’s themselves. These index pages like Categories & Archives would quickly update and the majority of visitors coming from Google search results were having a poor experience – the post that drew them in wasn’t obviously visible.

I knew I could use Robots.txt directives to control the INDEX-ing and FOLLOW-ing of my site, but I was hesitant about applying experimental rules to all Search Engine robots. Thankfully GoogleBot looks for a header specific to itself only, this let me apply custom rules to Google only very easily.

Using my Wordpress templates I added the following header on all index-style pages except the home page:

<meta name="GOOGLEBOT" content="NOINDEX,FOLLOW"/>

Basically this is instructing GoogleBot to follow links on this page, but not to index the page itself. The end result is that search results pointing to my blog are using the ‘permalink’ URL, not the index page it is listed on.

This is a(nother) minor release of SpamKit Plugin which provides some cool new features. This is checked into Subversion over at WP-Plugins.org and you can download the new version here spamkit-plugin.php.

New Features:

* Minor improvements to the use of TBT’s, any token used within 5 seconds of being generated will be declared invalid. This is to stop the majority of automated clients parsing and sending the TBT token.

* Added a ‘web badge’ for display on your blog pages, it shows the number of spam comments caught with SpamKit. To use it simply add the following where you want the badge to appear:

Alternatively, you can have this spamkit_badge method return you the HTML markup by calling spamkit_badge( true ), for example:

And it looks like this:

* Added a custom pingback to my own blog triggered when the plugin is installed and activated on your own blog. This is used for installation counting and version tracking. Future versions will have this as configurable and optional.

Known Issues:

* The HTML generated by spamkit_badge link’s back to the plugin using an absolute URL (/wp-content/plugins/spamkit-plugin.php) which may not suit everyone’s Wordpress installation. This will be addressed in the next release.

* SpamKit uses temporary files to store the count, saving the image generating part of the script from having to make SQL calls. To do this it is assumed that all systems have a “/tmp” directory which is writable by the user the WWW server is running as. Temporary file names are fairly unique, they are generated by taking the crc32 value of $_SERVER['SERVER_NAME'].

This is a minor release of SpamKit Plugin to update Gerry's TBT code which now incorporates the IP address from $_SERVER['REMOTE_ADDR'] into the validation. This is checked into Subversion over at WP-Plugins.org and you can download the new version here spamkit-plugin.php.

Changelog:

version 0.2 - updated TBT code with improvements from Gerard Calderhead, TBT now includes the IP address from $_SERVER['REMOTE_ADDR'] into the check and fails if the ip is different during validation.

Since moving my OpenSSH server down to its standard port number I have been hit daily by service scanning software and brute force password attacks. Gerry pointed out that sshdfilter can help.

sshdfilter blocks the frequent brute force attacks on ssh daemons, it does this by directly reading the sshd logging output and generating iptables rules, the process can be quick enough to block an attack before they get a chance to enter any password at all.

It's quick and simple to setup, I enabled email alerts to see what it gets upto and can report it is all working fine on my servers (Red Hat 9 customised).

It will block when triggered by:

The length of time the block remains in place is all configurable.

This is one of the main reasons I hate running SSH on the standard port numbers, every day I get log-alerts like these. As per usual I notify the originating ISP, at least I have an email template for it.

Failed logins from these:
invalid user abdul (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user abort (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user abs (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user adam (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user admin (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user admin (password) from 203.98.XXX.XXX: 14 Time(s)
invalid user advertise (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user alan (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user alcatel (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user alex (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user alex (password) from 203.98.XXX.XXX: 6 Time(s)
invalid user allan (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user aloha (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user alpha (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user alter (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user ameno (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user amman (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user andy (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user angel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user antidot (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user apache (password) from 125.240.XXX.XXX: 30 Time(s)
invalid user apache (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ariane (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user aron (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user art (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user artificial (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user asahi (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user aspect (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user aspidistra (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user atempt (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user atilla (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user atom (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user aurel (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user avsadmin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user azazel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user backup (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user base (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user bash (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user beast (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user berg (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user beta (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user binary (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user black (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user bobo (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user bogdan (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user book (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user bourn (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user brett (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user brian (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user buche (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cable (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cache (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cain (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cambera (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user camelia (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cesna (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user chat (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user chris (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user church (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user clark (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user client (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user coffee (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user common (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user costel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user costi (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user crack (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cristina (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user cyclon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dalton (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user danny (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user darling (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dasilva (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user data (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dave (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user david (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user david (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user davod (password) from 125.240.XXX.XXX: 2 Time(s)
invalid user deserve (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user desire (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dns (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user domain (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user donna (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user dool (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user down (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dragon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dudu (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user earth (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user elixir (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user elvis (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user epsilon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user eric (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user example (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user fadeh (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user fatih (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user fax (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user felix (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user fiat (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user filter (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user finale (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user fire (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user foon (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user ford (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user found (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user frank (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user freddy (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user ftpuser (password) from 125.240.XXX.XXX: 30 Time(s)
invalid user gamma (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ganja (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user gaspar (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user george (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user gerhard (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ghost (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user gone (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user grand (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user granicus (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user gregory (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user grims (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user guest (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user guest (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user gushi (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user hang (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user hassan (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user health (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user helen (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user hell (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user helmut (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user heracle (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user honour (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user host (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user http (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user httpd (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user iarin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ident (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user include (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user info (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user info (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user iolanda (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ion (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user ionut (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user irina (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jack (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user jamal (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user james (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user jasmina (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jason (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user java (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jeffrey (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jelem (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jenny (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user jerry (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user jessica (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user jessie (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user jhony (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user jiang (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jihad (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jim (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user joe (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user john (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user john (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user jupiter (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user just (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user justice (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user justin (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user kadir (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kain (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kaleb (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kelly (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user kevin (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user kevin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kline (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user koln (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kondor (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lampard (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user larry (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user laura (password) from 125.240.XXX.XXX: 16 Time(s)
invalid user laura (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user law (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lawyer (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user leroi (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user leslie (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user lex (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user library (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user library (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user light (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lincoln (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user linda (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user linux (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lisa (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user locco (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lost (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user louis (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user louise (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user lucky (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user mailtest (password) from 125.240.XXX.XXX: 24 Time(s)
invalid user malaga (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mano (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user maria (password) from 203.98.XXX.XXX: 6 Time(s)
invalid user mariana (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mark (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user mark (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user marte (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user marty (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user mary (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user master (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user matt (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user media (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mercur (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mercury (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user michael (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mike (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user mike (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user mind (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user minerva (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mister (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mistero (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mobifon (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user mohamed (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mona (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user monaco (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user monica (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mooka (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user moon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mount (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mrdev (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mumu (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user munis (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mysql (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user mysql (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user nancy (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user neptun (password) from 203.98.XXX.XXX: 3 Time(s)
invalid user nino (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user noise (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user nokia (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user office (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user okubo (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user omega (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user oracle (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user oracle (password) from 203.98.XXX.XXX: 10 Time(s)
invalid user oracle1 (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user osama (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user osiris (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user osman (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user palm (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user panama (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user pascal (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user patricia (password) from 125.240.XXX.XXX: 12 Time(s)
invalid user patrick (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user paul (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user paul (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user peter (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user pgsql (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user port (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user portal (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user postfix (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user postgres (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user public (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user quarter (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user rajev (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user read (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user rehash (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user relay (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user remove (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user rename (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user repection (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user request (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user resin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user restore (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user richard (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user richard (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user road (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user robert (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user robin (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user roger (password) from 125.240.XXX.XXX: 18 Time(s)
invalid user sales (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user sales (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user sam (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user samba (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user same (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sandy (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user sarah (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user saturn (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user scott (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user script (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user search (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user send (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user serafim (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user server (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user service (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user shadow (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shake (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sharon (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user sharon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shell (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shoot (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shop (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shrike (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sigmund (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user siliciu (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user silla (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user silva (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user silvia (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sirg (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user smash (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user smell (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user smuf (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user snake (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sole (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sombrero (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sorina (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sound (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user space (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sparc (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user spool (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sport (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user squad (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user staff (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stanley (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user start (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stealth (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user steel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stepfen (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stephen (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user steve (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user steven (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user stick (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user storm (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stream (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user student (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user student (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sun (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user support (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user support (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user susan (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user susan (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user system (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user target (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user tay (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user temp (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user temp (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user tener (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user test (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user test (password) from 203.98.XXX.XXX: 14 Time(s)
invalid user testuser (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user tetra (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user thanatos (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user thoor (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user tony (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user tony (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user torpe (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user track (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user travel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user tristan (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user truth (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user unix (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user user (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user user (password) from 203.98.XXX.XXX: 16 Time(s)
invalid user username (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user venus (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user verset (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user video (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user vincent (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user virtual (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user vision (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user visual (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user warez (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user web (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user webadmin (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user webadmin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user webmaster (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user webmaster (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user while (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user white (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user william (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user willy (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user wish (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user write (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user www (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user www-data (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user wwwrun (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user yarrow (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user zed (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user zoom (password) from 203.98.XXX.XXX: 2 Time(s)
root/password from 125.240.XXX.XXX: 30 Time(s)
root/password from 203.98.XXX.XXX: 36 Time(s)

Locked account login attempts:
apache : 32 Time(s)
mysql : 30 Time(s)
postfix : 26 Time(s)

However, my favourite ones are still the bots that try talking HTTP to my SMTP server:

unknown[61.128.XXX.XXX] sent non-SMTP command: POST / HTTP/1.1 : 1 Time(s)

To my absolute surprise, the Sitecom CN-502 USB Bluetooth Dongle works perfectly with out-of-the-box Fedora Core 4 x86_64. The lsusb output shows it’s a Cambridge Silicon Radio chip (0a12:0001) which is very widely used and well supported.

I bought this thing some time ago because of its protruding aerial; my original intention was to dismantle it and add a huge-gain antenna – Car Whisperer-esque - but I just haven't got around to doing it.

The lsusb output:

Bus 003 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)

For completeness, here is the rest of my config:

$ uname -a
Linux localhost 2.6.14-1.1656_FC4 #1 Thu Jan 5 22:13:55 EST 2006 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -q -a | grep -i bluez
bluez-hcidump-1.18-1
bluez-utils-2.15-7
bluez-pin-0.24-2
bluez-libs-2.15-1

And it working:

$ /etc/init.d/bluetooth start
Starting Bluetooth services: [ OK ]
$ hcitool scan
Scanning ...
00:XX:XX:XX:XX:XX XXXXXXXX

Not bad since I found it in a bargain bucket!

Related Links:

Sitecom CN-502 Product Support

This is the first release of a prototype plugin I wrote to detect incoming requests from search engines and highlight the words in your posts that match the search terms. It also detects local searches with Wordpress and highlights those terms too.

Installation is simple, copy search-terms-highlighter-plugin.php into your Wordpress plugins directory and Activate the plugin from your Admin screen.

FEATURES:

- Automatically highlights search terms used from Google, MSN & Yahoo
- Automatically highlights search terms used in local Wordpress searches

LIMITATIONS:

- The Highlight colour is hard coded to Yellow
- Only 'detects' search query strings from known search engines

TODO:

- Add options page to allow configuration of highlight colours
- Support different highlight colours for each search term
- Support DHTML/JS 'switching off' of highlighting
- More generic query string parser to support unknown search engines
- The preg_replace in sth_plugin_the_content can be optimised to replace all keywords in one operation

Download Plugin