Discussion:
Thomson 585 - event log curiosity
(too old to reply)
Kate Brown
2010-02-03 10:59:47 UTC
Permalink
What on earth does this extract from the log mean, can anyone tell me?
Still getting to know this machine!

Who are these Users logging out in the middle of the night? For example
88.250.224.191 appears to be some Turk, 189.27.209.194 someone in
Brazil?

A shields-up scan reveals that ports 21 (FTP), 23 (Telnet), and 80
(HTTP) are open. Can any kind soul tell me how one closes them without
destroying access that I might one day need?

Log extract follows:
Info Feb 3 05:56:22 SNTP Synchronised again to server: 158.152.1.76


Info Feb 3 05:42:19 LOGOUT User logged out on TELNET
(189.27.209.194)


Info Feb 3 05:42:09 LOGOUT User logged out on TELNET
(189.27.209.194)


Info Feb 3 05:33:08 LOGOUT User logged out on TELNET (189.59.59.52)


Info Feb 3 05:32:59 LOGOUT User logged out on TELNET (189.59.59.52)


Info Feb 3 04:56:22 SNTP Synchronised again to server: 158.152.1.76


Info Feb 3 04:46:33 LOGOUT User logged out on TELNET (78.163.53.86)


Info Feb 3 04:46:21 LOGOUT User logged out on TELNET (78.163.53.86)


Info Feb 3 04:45:36 LOGOUT User logged out on TELNET (78.163.53.86)


Info Feb 3 04:45:26 LOGOUT User logged out on TELNET (78.163.53.86)


Info Feb 3 04:39:34 LOGOUT User logged out on TELNET
(88.250.224.191)


Info Feb 3 04:39:23 LOGOUT User logged out on TELNET
(88.250.224.191)


Info Feb 3 04:27:08 LOGOUT User logged out on TELNET (78.183.153.86)


Info Feb 3 04:27:04 LOGOUT User logged out on TELNET (78.183.153.86)


Info Feb 3 04:21:54 LOGOUT User logged out on TELNET
(189.15.106.251)


Info Feb 3 04:21:38 LOGOUT User logged out on TELNET
(189.15.106.251)


Info Feb 3 04:21:27 LOGOUT User logged out on TELNET (88.228.3.208)


Info Feb 3 04:21:20 LOGOUT User logged out on TELNET (88.228.3.208)


Info Feb 3 04:19:58 LOGOUT User logged out on TELNET (85.105.22.179)


Info Feb 3 04:19:42 LOGOUT User logged out on TELNET (85.105.22.179)


Info Feb 3 04:08:41 LOGOUT User logged out on TELNET (78.179.60.50)


Info Feb 3 04:08:35 LOGOUT User logged out on TELNET (78.179.60.50)


Info Feb 3 04:06:50 LOGOUT User logged out on TELNET
(88.227.145.152)


Info Feb 3 04:06:41 LOGOUT User logged out on TELNET
(88.227.145.152)


Info Feb 3 04:03:03 LOGOUT User logged out on TELNET (88.226.59.217)


Info Feb 3 04:02:51 LOGOUT User logged out on TELNET (88.226.59.217)


Info Feb 3 03:56:21 SNTP Synchronised again to server: 158.152.1.76


Info Feb 3 03:53:15 LOGOUT User logged out on TELNET (77.49.214.177)


Info Feb 3 03:53:05 LOGOUT User logged out on TELNET (77.49.214.177)


Info Feb 3 03:53:03 LOGOUT User logged out on TELNET (88.245.35.125)


Info Feb 3 03:52:57 LOGOUT User logged out on TELNET (88.245.35.125)


Info Feb 3 03:07:42 LOGOUT User logged out on TELNET
(88.242.248.234)


Info Feb 3 03:07:34 LOGOUT User logged out on TELNET
(88.242.248.234)


Info Feb 3 02:56:22 SNTP Synchronised again to server: 158.152.1.76


Info Feb 3 02:22:51 LOGOUT User logged out on TELNET (78.161.47.112)


Info Feb 3 02:22:39 LOGOUT User logged out on TELNET (78.161.47.112)


Info Feb 3 02:13:11 LOGOUT User logged out on TELNET
(94.123.159.178)


Info Feb 3 02:12:59 LOGOUT User logged out on TELNET
(94.123.159.178)


Info Feb 3 01:56:22 SNTP Synchronised again to server: 158.152.1.76


Info Feb 3 01:53:19 LOGOUT User logged out on TELNET
(88.250.210.212)


Info Feb 3 01:53:05 LOGOUT User logged out on TELNET
(88.250.210.212)


Info Feb 3 01:50:57 LOGOUT User logged out on TELNET (88.247.29.213)


Info Feb 3 01:50:46 LOGOUT User logged out on TELNET (88.247.29.213)


Info Feb 3 01:40:21 LOGOUT User logged out on TELNET (118.92.54.181)


Info Feb 3 01:39:52 LOGOUT User logged out on TELNET (118.92.54.181)
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
Stephen Wolstenholme
2010-02-03 11:38:55 UTC
Permalink
On Wed, 3 Feb 2010 10:59:47 +0000, Kate Brown
Post by Kate Brown
A shields-up scan reveals that ports 21 (FTP), 23 (Telnet), and 80
(HTTP) are open. Can any kind soul tell me how one closes them without
destroying access that I might one day need?
The easy way is to switch the router off.

Why do you need to leave it on during the night if you are not using
it?

Steve
--
Neural Planner Software Ltd www.NPSL1.com

Neural network applications, help and support.
Andy
2010-02-03 12:14:56 UTC
Permalink
Post by Stephen Wolstenholme
On Wed, 3 Feb 2010 10:59:47 +0000, Kate Brown
Post by Kate Brown
A shields-up scan reveals that ports 21 (FTP), 23 (Telnet), and 80
(HTTP) are open. Can any kind soul tell me how one closes them without
destroying access that I might one day need?
The easy way is to switch the router off.
Why do you need to leave it on during the night if you are not using
it?
Doesn't doing that result in your speed being progressively reduced by
the ADSL system?
--
Andy Taylor [Editor, Austrian Philatelic Society].
Visit <URL:http://www.austrianphilately.com>
Stephen Wolstenholme
2010-02-03 12:49:47 UTC
Permalink
Post by Andy
Post by Stephen Wolstenholme
On Wed, 3 Feb 2010 10:59:47 +0000, Kate Brown
Post by Kate Brown
A shields-up scan reveals that ports 21 (FTP), 23 (Telnet), and 80
(HTTP) are open. Can any kind soul tell me how one closes them without
destroying access that I might one day need?
The easy way is to switch the router off.
Why do you need to leave it on during the night if you are not using
it?
Doesn't doing that result in your speed being progressively reduced by
the ADSL system?
It hasn't reduced the speed on my system and I switch the whole lot
off every night.

Steve
--
Neural Planner Software Ltd www.NPSL1.com

Neural network applications, help and support.
Kate Brown
2010-02-03 15:04:54 UTC
Permalink
Post by Stephen Wolstenholme
Post by Andy
Post by Stephen Wolstenholme
On Wed, 3 Feb 2010 10:59:47 +0000, Kate Brown
Post by Kate Brown
A shields-up scan reveals that ports 21 (FTP), 23 (Telnet), and 80
(HTTP) are open. Can any kind soul tell me how one closes them without
destroying access that I might one day need?
The easy way is to switch the router off.
Why do you need to leave it on during the night if you are not using
it?
Doesn't doing that result in your speed being progressively reduced by
the ADSL system?
It hasn't reduced the speed on my system and I switch the whole lot
off every night.
Oddly enough, my speed *is* being reduced. Although the machine says it
has been up for a day or so, the sync speed has changed twice, and
always downwards. It's getting a lot less than the Linksys achieved,
but it is undoubtedly more stable.
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
Paul Terry
2010-02-03 12:47:08 UTC
Permalink
Post by Andy
Post by Stephen Wolstenholme
The easy way is to switch the router off.
Why do you need to leave it on during the night if you are not using
it?
Doesn't doing that result in your speed being progressively reduced by
the ADSL system?
No. The IP profile only gets reduced if the router is losing sync
something like 10 times an hour or more. Switching it off overnight
(which is what I do) has no effect on the profile.
--
Paul Terry
Kate Brown
2010-02-03 15:22:17 UTC
Permalink
Post by Stephen Wolstenholme
On Wed, 3 Feb 2010 10:59:47 +0000, Kate Brown
Post by Kate Brown
A shields-up scan reveals that ports 21 (FTP), 23 (Telnet), and 80
(HTTP) are open. Can any kind soul tell me how one closes them without
destroying access that I might one day need?
The easy way is to switch the router off.
Why do you need to leave it on during the night if you are not using
it?
Updates, mostly, also I thought it wasn't good for it to be switched on
and off a lot, also I thought it would upset the line sync speed, which
isn't great anyway.

But presumably switching it off would only thwart those who tried at
night. It's on all day because we are using it, and I'm still getting
these 'LOGOUT' entries. By the way, why is it just LOGOUT? Do they
never LOGIN?
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
AlanC
2010-02-03 13:21:17 UTC
Permalink
I dont have one of these routers but if you are not using FTP, TELNET
and HTTP into your home network then it would be better to switch off
these services.

I have had a quick look at the manual <http://
www.thomsonbroadbandpartner.com/dsl-modems-gateways/products/product-detail.php?id=161>
and it explains how to setup services into your network on page 38 or
the user guide. It may be that by default, these services are defined
which is why they are showing up as open. I dont think its actually
causing a problem because you need to explicilty tell the router which
PC on your network services these requests (i.e. what the IP address
is of your FTP server). These requests are probably just being
dropped. Personally, I would delete them as it appears to be easy to
add them back later.

Alan
Kate Brown
2010-02-03 15:19:28 UTC
Permalink
Post by AlanC
I dont have one of these routers but if you are not using FTP, TELNET
and HTTP into your home network then it would be better to switch off
these services.
I have had a quick look at the manual <http://
www.thomsonbroadbandpartner.com/dsl-modems-gateways/products/product-det
ail.php?id=161>
and it explains how to setup services into your network on page 38 or
the user guide. It may be that by default, these services are defined
which is why they are showing up as open. I dont think its actually
causing a problem because you need to explicilty tell the router which
PC on your network services these requests (i.e. what the IP address
is of your FTP server). These requests are probably just being
dropped. Personally, I would delete them as it appears to be easy to
add them back later.
I'm awfully sorry but I don't understand any of that! I looked in the
'Games and Applications' settings and nothing is assigned at all. Nor
are HTTP/FTP/Telnet apparently configurable, or not from that page.

What does
Post by AlanC
These requests are probably just being
dropped. Personally, I would delete them as it appears to be easy to
add them back later.
mean? I can clear the log, but presumably that doesn't do anything
about whether people/computers are trying to get in or not.

Moreover, don't all the computers on the network need HTTP? I haven't
got an FTP server, and I don't often use Telnet, so I could do without
those.

What would be best is if one could stealth them, as all the other ports
are. How does one do that, does anybody know?
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
AlanC
2010-02-03 17:04:59 UTC
Permalink
Post by AlanC
I dont have one of these routers but if you are not using FTP, TELNET
and HTTP into your home network then it would be better to switch off
these services.
I have had a quick look at the manual <http://
www.thomsonbroadbandpartner.com/dsl-modems-gateways/products/product-det
ail.php?id=161>
and it explains how to setup services into your network on page 38 or
the user guide.  It may be that by default, these services are defined
which is why they are showing up as open.  I dont think its actually
causing a problem because you need to explicilty tell the router which
PC on your network services these requests (i.e. what the IP address
is of your FTP server).  These requests are probably just being
dropped.  Personally, I would delete them as it appears to be easy to
add them back later.
I'm awfully sorry but I don't understand any of that!  I looked in the
'Games and Applications' settings and nothing is assigned at all.  Nor
are HTTP/FTP/Telnet apparently configurable, or not from that page.
When you say that nothing is assigned, do you mean that there is an
entry already there for HTTP, FTP and TELNET but the destination IP
address is blank?
If it is then the router may be accepting connections on these ports
(HTTP, FTP etc are just names given to ports used for these services,
like host names are used instead of IP addresses), but then doing
nothing with the connection (dropping/discarding it). If the web
interface gives you the ability to disable or even delete these pre-
defined services then I would do.
What does>These requests are probably just being
Post by AlanC
dropped.  Personally, I would delete them as it appears to be easy to
add them back later.
mean?  I can clear the log, but presumably that doesn't do anything
about whether people/computers are trying to get in or not.
You are correct, clearing the entries from the log is just removing
traces of the fact that someone has attempted to connect into your
network on these services. See my reply above. If the service isnt
going anywhere then it isnt really a problem, its just neater not to
have these if you dont need/use them.
Moreover, don't all the computers on the network need HTTP?  I haven't
got an FTP server, and I don't often use Telnet, so I could do without
those.
Kind of. This is the difference between outbound and inbound
traffic. You will be using HTTP outbound from your network to connect
to web servers on computers connected to the internet. From their
perspective, it is an inbound HTTP connection. If you dont have a web
server running on your network providing a service for other people
then you dont need to allow inbound (into your network) HTTP
connections but you would want to allow outbound HTTP connections so
that you can look at other peoples web servers.
The 'Games and Applications' section is about enabling inbound (into
your network) connections for various services.
What would be best is if one could stealth them, as all the other ports
are. How does one do that, does anybody know?
Stealthing is more about having something open but not appearing
open. Its better to just close it if its not required. If the 'Games
and Applications' section allows you to disable or delete the services
then this may close those ports. It really depends on what the router
is doing 'under the hood'. Mike mentioned about telnetd being
switched on. A lot of routers basically have cut down linux type
systems running on. telnetd is basically a program that sits there
listening on the TELNET port for someone to connect to it. If telnetd
(or something similar) is running then when a port scan (which is what
the shields up site does) is run on your IP address, it can see that
the TELNET port has something listening on it. If telnetd isnt
running then a port scan doesnt get a response and reports it as
closed.
If disabling or deleting these services doesnt shut down the process
listening on these ports then they may still be reported as open. In
reality, unless there is some kind of security flaw in the router
firmware (it has been know), then its not really going to make any
difference.

I have a seperate firewall device on my network and these ports are
explicitly blocked but that doesnt stop people from trying. My logs
are full of attempted connections on various ports.
--
Kate B
PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally- Hide quoted text -
- Show quoted text -
Mike Tomlinson
2010-02-03 14:25:45 UTC
Permalink
Post by Kate Brown
Info Feb 3 05:42:19 LOGOUT User logged out on TELNET
(189.27.209.194)
Info Feb 3 05:42:09 LOGOUT User logged out on TELNET
(189.27.209.194)
Info Feb 3 05:33:08 LOGOUT User logged out on TELNET (189.59.59.52)
Info Feb 3 05:32:59 LOGOUT User logged out on TELNET (189.59.59.52)
Info Feb 3 04:56:22 SNTP Synchronised again to server: 158.152.1.76
Info Feb 3 04:46:33 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:46:21 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:45:36 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:45:26 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:39:34 LOGOUT User logged out on TELNET
(88.250.224.191)
Post by Kate Brown
Info Feb 3 04:39:23 LOGOUT User logged out on TELNET
(88.250.224.191)
Don't tell me Demon are sending out routers with telnetd switched on to
the world..
--
Mike Tomlinson
rothers
2010-02-03 15:48:57 UTC
Permalink
Post by Kate Brown
Post by Kate Brown
Info Feb 3 05:42:19 LOGOUT User logged out on TELNET
(189.27.209.194)
Info Feb 3 05:42:09 LOGOUT User logged out on TELNET
(189.27.209.194)
Info Feb 3 05:33:08 LOGOUT User logged out on TELNET (189.59.59.52)
Info Feb 3 05:32:59 LOGOUT User logged out on TELNET (189.59.59.52)
Info Feb 3 04:56:22 SNTP Synchronised again to server: 158.152.1.76
Info Feb 3 04:46:33 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:46:21 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:45:36 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:45:26 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:39:34 LOGOUT User logged out on TELNET
(88.250.224.191)
Post by Kate Brown
Info Feb 3 04:39:23 LOGOUT User logged out on TELNET
(88.250.224.191)
Don't tell me Demon are sending out routers with telnetd switched on to
the world..
Looks like it and with default passwords on the WAN facing admin interfaces !
Kate Brown
2010-02-03 15:53:31 UTC
Permalink
Post by rothers
Post by Kate Brown
Post by Kate Brown
Info Feb 3 05:42:19 LOGOUT User logged out on TELNET
(189.27.209.194)
Info Feb 3 05:42:09 LOGOUT User logged out on TELNET
(189.27.209.194)
Info Feb 3 05:33:08 LOGOUT User logged out on TELNET (189.59.59.52)
Info Feb 3 05:32:59 LOGOUT User logged out on TELNET (189.59.59.52)
Info Feb 3 04:56:22 SNTP Synchronised again to server: 158.152.1.76
Info Feb 3 04:46:33 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:46:21 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:45:36 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:45:26 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:39:34 LOGOUT User logged out on TELNET
(88.250.224.191)
Post by Kate Brown
Info Feb 3 04:39:23 LOGOUT User logged out on TELNET
(88.250.224.191)
Don't tell me Demon are sending out routers with telnetd switched on to
the world..
Looks like it and with default passwords on the WAN facing admin interfaces !
So what can I do about this? I've changed SSID name and password,
obviously.
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
Kate Brown
2010-02-03 16:04:22 UTC
Permalink
Post by Kate Brown
Post by rothers
Post by Kate Brown
Post by Kate Brown
Info Feb 3 05:42:19 LOGOUT User logged out on TELNET
(189.27.209.194)
Info Feb 3 05:42:09 LOGOUT User logged out on TELNET
(189.27.209.194)
Info Feb 3 05:33:08 LOGOUT User logged out on TELNET (189.59.59.52)
Info Feb 3 05:32:59 LOGOUT User logged out on TELNET (189.59.59.52)
Info Feb 3 04:56:22 SNTP Synchronised again to server: 158.152.1.76
Info Feb 3 04:46:33 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:46:21 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:45:36 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:45:26 LOGOUT User logged out on TELNET (78.163.53.86)
Info Feb 3 04:39:34 LOGOUT User logged out on TELNET
(88.250.224.191)
Post by Kate Brown
Info Feb 3 04:39:23 LOGOUT User logged out on TELNET
(88.250.224.191)
Don't tell me Demon are sending out routers with telnetd switched on to
the world..
Looks like it and with default passwords on the WAN facing admin interfaces !
So what can I do about this? I've changed SSID name and password,
obviously.
Have just found interesting discussion here:
<http://forums.thinkbroadband.com/dslrouter/3383118-thomson-speedtouch-58
5-v7-close-ports-2123-amp-80.html?fpart=all&vc=1>

<quote>
Here is what I did on my Demon supplied Thomson 585 after noticing
repeated attempted telnet logins :-)

Telnet to the router login as admin / your password
Type ‘menu’ to get into the interactive menu.
To remove external TELNET/FTP/HTTP/PING_RESPONDER interfaces go to
‘service->system’ and use ‘ifdelete’ option to remove wan from
the list of interfaces.
Press Ctrl+C to exit out of the ‘menu’ system and type ‘saveall’
to make the changes permanent.
You can test the config before you save it.
<end quote>

Is this what I should be doing? And while I can get as far as
'ifdelete' I am very wary of going any further. Any advice gratefully
received.
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
Mike Tomlinson
2010-02-03 16:38:10 UTC
Permalink
Post by Kate Brown
Telnet to the router login as admin / your password
Type ‘menu’ to get into the interactive menu.
To remove external TELNET/FTP/HTTP/PING_RESPONDER interfaces go to
‘service->system’ and use ‘ifdelete’ option to remove wan from
the list of interfaces.
In English, this is asking if you want the router to be accessible on
telnet/ftp/http/ping from the WAN (the ADSL that connects you to the big
bad internet).

The names are the network services that the router 'listens' on for
connections from outside. telnet is port 23, ftp is 21, http is 80
(this one is dangerous as it allows the router to be managed from
outside), ping is just a diagnostic tool but it allows someone to see if
you are there (analogous to someone you don't want to talk to rattling
the door handle and going cooooo-eeeee! with an axe in his hand)

You don't, so switch them off and saveall.
Post by Kate Brown
Is this what I should be doing?
Yes. I CANNOT believe the router was supplied with these settings by
default. Did you get it new?
Post by Kate Brown
Any advice gratefully
received.
You're doing fine. I'd be happier if someone with the same router could
talk you through it, here or via phone. I don't have one (it's about
the only one I don't!)

And to flatly contradict other 'advice' you have had: there's no problem
leaving the router on overnight. Most people leave the it on and
shutdown the PC instead, but it might suit you to do it differently.
For me, I leave both on and turn the monitors off.
--
Mike Tomlinson
Kate Brown
2010-02-03 17:00:18 UTC
Permalink
Post by Mike Tomlinson
Post by Kate Brown
Telnet to the router login as admin / your password
Type ‘menu’ to get into the interactive menu.
To remove external TELNET/FTP/HTTP/PING_RESPONDER interfaces go to
‘service->system’ and use ‘ifdelete’ option to remove wan from
the list of interfaces.
In English, this is asking if you want the router to be accessible on
telnet/ftp/http/ping from the WAN (the ADSL that connects you to the big
bad internet).
The names are the network services that the router 'listens' on for
connections from outside. telnet is port 23, ftp is 21, http is 80
(this one is dangerous as it allows the router to be managed from
outside), ping is just a diagnostic tool but it allows someone to see if
you are there (analogous to someone you don't want to talk to rattling
the door handle and going cooooo-eeeee! with an axe in his hand)
You don't, so switch them off and saveall.
Thanks, Mike. I've got as far as 'ifdelete'. Will it give me these
options specifically? I'm afraid if I get too far into the menu I'll
delete something I don't want to.
Post by Mike Tomlinson
Post by Kate Brown
Is this what I should be doing?
Yes. I CANNOT believe the router was supplied with these settings by
default. Did you get it new?
Arrived, Demon-branded, a few days ago :(
Post by Mike Tomlinson
Post by Kate Brown
Any advice gratefully
received.
You're doing fine. I'd be happier if someone with the same router could
talk you through it, here or via phone. I don't have one (it's about
the only one I don't!)
And to flatly contradict other 'advice' you have had: there's no problem
leaving the router on overnight. Most people leave the it on and
shutdown the PC instead, but it might suit you to do it differently.
For me, I leave both on and turn the monitors off.
We often turn the machines off, but not consistently and not
concertedly. Presumably this doesn't make any difference to whether
anyone is trying to get into the system or not?
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
Mike Tomlinson
2010-02-03 19:24:15 UTC
Permalink
Post by Kate Brown
Thanks, Mike. I've got as far as 'ifdelete'. Will it give me these
options specifically? I'm afraid if I get too far into the menu I'll
delete something I don't want to.
No, that's why I suggested you wait for someone with the same router to
chime in and work through the settings with you. It's much easier if
someone has the same model.
Post by Kate Brown
Arrived, Demon-branded, a few days ago :(
Baad. Very bad. Someone at Demon Towers needs a public hanging and
flogging.
Post by Kate Brown
We often turn the machines off, but not consistently and not
concertedly.
That's fine :o) If it's off, nothing can get in it. But don't be too
paranoid, just keep well up with Windows update etc. and stick another
pin in the Bill Gates voodoo doll next time Windows says it needs a
reboot.
Post by Kate Brown
Presumably this doesn't make any difference to whether
anyone is trying to get into the system or not?
No.
--
(\__/)
(='.'=) Bunny says Windows 7 is Vi$ta reloaded.
(")_(") Loading Image...
Brian Wingfield
2010-02-03 17:15:59 UTC
Permalink
Post by Kate Brown
Post by Kate Brown
Post by rothers
Post by Mike Tomlinson
Don't tell me Demon are sending out routers with telnetd switched on to
the world..
Looks like it and with default passwords on the WAN facing admin interfaces !
So what can I do about this? I've changed SSID name and password,
obviously.
<http://forums.thinkbroadband.com/dslrouter/3383118-thomson-speedtouch-58
5-v7-close-ports-2123-amp-80.html?fpart=all&vc=1>
<quote>
Here is what I did on my Demon supplied Thomson 585 after noticing
repeated attempted telnet logins :-)
Telnet to the router login as admin / your password
Type ‘menu’ to get into the interactive menu.
To remove external TELNET/FTP/HTTP/PING_RESPONDER interfaces go to
‘service->system’ and use ‘ifdelete’ option to remove wan from
the list of interfaces.
Press Ctrl+C to exit out of the ‘menu’ system and type ‘saveall’
to make the changes permanent.
You can test the config before you save it.
<end quote>
Is this what I should be doing? And while I can get as far as
'ifdelete' I am very wary of going any further. Any advice gratefully
received.
This problem has been discussed before in this newsgroup. You could
probably find it, but in a nutshell, to remove these services:

telnet to the router. You will need the router administrator username
and password. If you don't have them, let me know and I will email them
to you. Then enter the following:

service system ifdelete name=TELNET group=wan
service system ifdelete name=HTTP group=wan
service system ifdelete name=FTP group=wan
service system ifdelete name=PING_RESPONDER group=wan
saveall

For heavens sake, make sure you enter wan, not lan!

HTH
Brian Wingfield
Kate Brown
2010-02-03 18:00:10 UTC
Permalink
Post by Brian Wingfield
Post by Kate Brown
Post by Kate Brown
Post by rothers
Post by Mike Tomlinson
Don't tell me Demon are sending out routers with telnetd switched on to
the world..
Looks like it and with default passwords on the WAN facing admin interfaces !
So what can I do about this? I've changed SSID name and password,
obviously.
<http://forums.thinkbroadband.com/dslrouter/3383118-thomson-speedtouch-58
5-v7-close-ports-2123-amp-80.html?fpart=all&vc=1>
<quote>
Here is what I did on my Demon supplied Thomson 585 after noticing
repeated attempted telnet logins :-)
Telnet to the router login as admin / your password
Type ‘menu’ to get into the interactive menu.
To remove external TELNET/FTP/HTTP/PING_RESPONDER interfaces go to
‘service->system’ and use ‘ifdelete’ option to remove wan from
the list of interfaces.
Press Ctrl+C to exit out of the ‘menu’ system and type ‘saveall’
to make the changes permanent.
You can test the config before you save it.
<end quote>
Is this what I should be doing? And while I can get as far as
'ifdelete' I am very wary of going any further. Any advice gratefully
received.
This problem has been discussed before in this newsgroup. You could
telnet to the router. You will need the router administrator username
and password. If you don't have them, let me know and I will email
service system ifdelete name=TELNET group=wan
service system ifdelete name=HTTP group=wan
service system ifdelete name=FTP group=wan
service system ifdelete name=PING_RESPONDER group=wan
saveall
For heavens sake, make sure you enter wan, not lan!
HTH
Brian Wingfield
Thanks, Brian, will try this later when local activity has subsided!
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
Brian Howie
2010-02-03 21:20:58 UTC
Permalink
Post by Brian Wingfield
telnet to the router. You will need the router administrator username
and password. If you don't have them, let me know and I will email
them to
I seem to be able to telnet to my router without using the admin
username and password. Even more worrying I can open the password file
and read the password !!

Better investigate

B
--
Brian Howie
Kate Brown
2010-02-03 23:02:58 UTC
Permalink
Post by Brian Howie
Post by Brian Wingfield
telnet to the router. You will need the router administrator username
and password. If you don't have them, let me know and I will email
them to
I seem to be able to telnet to my router without using the admin
username and password. Even more worrying I can open the password file
and read the password !!
Better investigate
B
Where's the password file? When I telnetted into my router I had to
give current username and password (which I've already changed from the
default).
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
Brian Howie
2010-02-03 23:56:22 UTC
Permalink
Post by Kate Brown
Post by Brian Howie
Post by Brian Wingfield
telnet to the router. You will need the router administrator username
and password. If you don't have them, let me know and I will email
them to
I seem to be able to telnet to my router without using the admin
username and password. Even more worrying I can open the password file
and read the password !!
Better investigate
B
Where's the password file? When I telnetted into my router I had to
give current username and password (which I've already changed from the
default).
It comes up with a busybox linux
interface; it's under /etc htpasswd
mines a Netgear DG384

Thomson will be different.

B
--
Brian Howie
Mark
2010-02-03 17:32:03 UTC
Permalink
Post by Kate Brown
<http://forums.thinkbroadband.com/dslrouter/3383118-thomson-speedtouch-58
5-v7-close-ports-2123-amp-80.html?fpart=all&vc=1>
<quote>
Here is what I did on my Demon supplied Thomson 585 after noticing
repeated attempted telnet logins :-)
Telnet to the router login as admin / your password
Type ‘menu’ to get into the interactive menu.
To remove external TELNET/FTP/HTTP/PING_RESPONDER interfaces go to
‘service->system’ and use ‘ifdelete’ option to remove wan from
the list of interfaces.
Press Ctrl+C to exit out of the ‘menu’ system and type ‘saveall’
to make the changes permanent.
You can test the config before you save it.
<end quote>
Is this what I should be doing? And while I can get as far as
'ifdelete' I am very wary of going any further. Any advice gratefully
received.
Not exactly the same problem but the Demon-supplied router with open ports is discussed in
this thread:

http://groups.google.com/group/demon.service/browse_thread/thread/cf273d4011e307ce

I think this post has the best information:

http://groups.google.com/group/demon.service/msg/6f39513758ec41b9

..it also includes the ifdelete stuff you've already discovered.

--
Mark
Kate Brown
2010-02-03 17:59:35 UTC
Permalink
Post by Mark
Post by Kate Brown
<http://forums.thinkbroadband.com/dslrouter/3383118-thomson-speedtouch-58
5-v7-close-ports-2123-amp-80.html?fpart=all&vc=1>
<quote>
Here is what I did on my Demon supplied Thomson 585 after noticing
repeated attempted telnet logins :-)
Telnet to the router login as admin / your password
Type ‘menu’ to get into the interactive menu.
To remove external TELNET/FTP/HTTP/PING_RESPONDER interfaces go to
‘service->system’ and use ‘ifdelete’ option to remove wan from
the list of interfaces.
Press Ctrl+C to exit out of the ‘menu’ system and type ‘saveall’
to make the changes permanent.
You can test the config before you save it.
<end quote>
Is this what I should be doing? And while I can get as far as
'ifdelete' I am very wary of going any further. Any advice gratefully
received.
Not exactly the same problem but the Demon-supplied router with open ports is discussed in
http://groups.google.com/group/demon.service/browse_thread/thread/cf273d
4011e307ce
http://groups.google.com/group/demon.service/msg/6f39513758ec41b9
..it also includes the ifdelete stuff you've already discovered.
Thanks. I had seen that post, but didn't think I could use that
information - the OP actually wanted an FTP server, if I remember, which
didn't apply to me.
--
Kate B

PS 'elvira' is spamtrapped - please reply to 'elviraspam' at cockaigne dot org dot uk if you
want to reply personally
John Aldred
2010-02-04 13:49:46 UTC
Permalink
Post by Kate Brown
What on earth does this extract from the log mean, can anyone tell me?
Still getting to know this machine!
Who are these Users logging out in the middle of the night? For example
88.250.224.191 appears to be some Turk, 189.27.209.194 someone in
Brazil?
A shields-up scan reveals that ports 21 (FTP), 23 (Telnet), and 80
(HTTP) are open. Can any kind soul tell me how one closes them without
destroying access that I might one day need?
I also have the Thompson TG585 v7 pre-configured by Demon.

I checked mine on grc.com ShieldsUp and found the same as you.

Having looked at the comment from Brian Wingfield in this thread, I decided
to apply the changes he suggested.

This appears to have worked fine. ShieldsUp now shows me in full stealth
mode.

I would hasten to add that before applying these changes, I did a backup of
the configuration file from the TG585. I have also done a backup of my
modified configuration. That way I can switch between the two should the
need arise.
--
John Aldred
Loading...