Project

General

Profile

Forums » General »

TVHeadend compromised?

Added by John Doe over 9 years ago

Just noticed some interesting log entries:

Aug 14 19:30:10 raspberrypi tvheadend2071: http: 78.137.40.55: HTTP/1.0 GET http://www.google.com/ -- 404
Aug 14 19:35:32 raspberrypi tvheadend2071: http: 78.137.40.55: HTTP/1.1 GET /status/ -- 401

A Ukrainian IP address is being logged, obviously not mine. I get the 2nd log entry sometimes for my own IP as well, I suppose when connecting to the web interface, but I do not see what the google.com means.

Does this mean that somebody found my IP and port and gained access to the web interface?


Replies (4)

RE: TVHeadend compromised? - Added by Mark Clarkstone over 9 years ago

As long as you don't have open access (All accounts should have strong passwords) you should (see note below..) be fine.
It looks like someone is testing for vulnerabilities to gain higher access to your system & is obviously failing.

If you're really worried install csf/lfd

* I cannot guarantee the security of your system, if someone really wants access to your system they'll find a way.

RE: TVHeadend compromised? - Added by Alex A over 9 years ago

You're probably just being scanned - If you don't use a firewall, don't expect to be anonymous on the internet.
The status code for the first request is 404 not found (it passed http://google.com/ as the url to be requested from you), and for the second one 401 authorization required - meaning he didn't manage to log in.

1. use complex usernames / passwords (not dictionary based ones)
2. restrict access to certain ips only, if you can
3. csf/lfd as has been suggested, or fail2ban

I'd actually be more worried about ssh scanning / bruteforcing.

RE: TVHeadend compromised? - Added by saen acro over 9 years ago

superuser account, rest just users

superuser is in

/home/hts/.hts/tvheadend/superuser

and its not visible in web interface

RE: TVHeadend compromised? - Added by John Doe over 9 years ago

Thanks for the replies. I think I'll restrict the IP range that has access to the web interface. I've already dealt with SSH bruteforcing, which was quite a problem (used 10% of my CPU and I got tens of requests every minute).

    (1-4/4)