Forum


Notice to all users

We are migrating towards a new forum system located at community.teamspeak.com, as such this forum will become read-only on January 29, 2020

Results 1 to 6 of 6
  1. #1
    Join Date
    June 2011
    Location
    Baghdad, Iraq
    Posts
    367

    Server security breach ? OR?

    Hello

    since yesterday a annoying guy keep joining the server talking sh*t etc..

    we keep banning him he keeps coming back with new ID/IP so we locked the server and he got the password from someone somehow ..

    and he gave him self server groups out of nowhere cant see anything in the logs no token used no other admin gave powers nothing

    and am sure of my permissions there is nothing he can do there he also add him self to server admin group somehow ..

    here is what the log says about him

    Code:
    	Line 1261: 2011-09-26 18:10:37.261237|INFO    |VirtualServer |  1| client connected 'scorpion'(id:839) from 149.255.232.179:2401
    	Line 1293: 2011-09-26 18:18:16.356954|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839) reason 'reasonmsg=leaving'
    	Line 1445: 2011-09-26 18:48:14.797083|INFO    |VirtualServer |  1| client connected 'scorpion'(id:839) from 149.255.232.179:4541
    	Line 1448: 2011-09-26 18:48:31.341421|INFO    |VirtualServer |  1| client connected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫1'(id:839) from 149.255.232.179:4548
    	Line 1449: 2011-09-26 18:48:38.056573|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫1'(id:839) reason 'reasonmsg=leaving'
    	Line 1726: 2011-09-26 19:37:12.996858|INFO    |VirtualServer |  1| client connected 'kado love bea'(id:839) from 149.255.232.179:2104
    	Line 1727: 2011-09-26 19:37:18.952076|INFO    |VirtualServer |  1| client disconnected 'kado love bea'(id:839) reason 'reasonmsg=leaving'
    	Line 2404: 2011-09-26 21:28:55.559397|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839) reason 'reasonmsg=connection lost'
    	Line 2965: 2011-09-26 23:39:59.893066|INFO    |VirtualServer |  1| client connected 'kado love bea'(id:839) from 149.255.254.49:2155
    	Line 2970: 2011-09-26 23:43:08.353512|INFO    |VirtualServer |  1| client connected 'kado love bea1'(id:839) from 149.255.254.49:2623
    	Line 2971: 2011-09-26 23:43:16.626061|INFO    |VirtualServer |  1| client disconnected 'kado love bea1'(id:839) reason 'reasonmsg=leaving'
    	Line 3117: 2011-09-27 00:49:46.610992|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839) reason 'reasonmsg=leaving'
    	Line 4970: 2011-09-27 13:26:37.686271|INFO    |VirtualServer |  1| client connected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839) from 149.255.199.255:4001
    	Line 5436: 2011-09-27 14:02:42.260940|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839) reason 'reasonmsg=leaving'
    	Line 11523: 2011-09-28 19:03:34.957887|INFO    |VirtualServer |  1| client connected 'all right'(id:839) from 149.255.234.4:1143
    	Line 11535: 2011-09-28 19:06:14.352882|INFO    |VirtualServer |  1| client disconnected 'all right'(id:839) reason 'reasonmsg=leaving'
    	Line 11536: 2011-09-28 19:06:14.892905|INFO    |VirtualServer |  1| client connected 'all right'(id:839) from 149.255.234.4:1143
    	Line 11541: 2011-09-28 19:06:48.385237|INFO    |VirtualServer |  1| client disconnected 'all right'(id:839) reason 'reasonmsg=leaving'
    	Line 11542: 2011-09-28 19:06:49.099403|INFO    |VirtualServer |  1| client connected 'all right'(id:839) from 149.255.234.4:1143
    	Line 11595: 2011-09-28 19:25:32.117151|INFO    |VirtualServer |  1| client disconnected 'all right'(id:839) reason 'reasonmsg=leaving'
    	Line 11626: 2011-09-28 19:35:59.882561|INFO    |VirtualServer |  1| client connected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839) from 149.255.234.4:1143
    	Line 11639: 2011-09-28 19:40:44.176025|INFO    |VirtualServer |  1| client connected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫1'(id:839) from 149.255.255.60:57524
    	Line 11642: 2011-09-28 19:40:56.351657|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫1'(id:839) reason 'reasonmsg=leaving'
    	Line 11646: 2011-09-28 19:41:51.479890|INFO    |VirtualServer |  1| client connected 'all right'(id:839) from 149.255.234.4:1656
    	Line 11647: 2011-09-28 19:41:57.450840|INFO    |VirtualServer |  1| client connected 'all right1'(id:839) from 149.255.234.4:1659
    	Line 11651: 2011-09-28 19:42:12.968899|INFO    |VirtualServer |  1| client disconnected 'all right'(id:839) reason 'reasonmsg=leaving'
    	Line 11652: 2011-09-28 19:42:21.620604|INFO    |VirtualServer |  1| client disconnected 'all right1'(id:839) reason 'reasonmsg=leaving'
    	Line 11680: 2011-09-28 19:47:41.050814|INFO    |VirtualServer |  1| client connected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫1'(id:839) from 149.255.234.4:1748
    	Line 11681: 2011-09-28 19:47:43.966641|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫1'(id:839) reason 'reasonmsg=leaving'
    	Line 11684: 2011-09-28 19:48:19.667785|INFO    |VirtualServer |  1| client connected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫1'(id:839) from 149.255.234.4:1756
    	Line 11687: 2011-09-28 19:48:25.325178|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫1'(id:839) reason 'reasonmsg=leaving'
    	Line 11695: 2011-09-28 19:50:34.060218|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839) reason 'reasonmsg=leaving'
    	Line 11696: 2011-09-28 19:50:36.943006|INFO    |VirtualServer |  1| client connected 'Ľ&#243;Ť ļ&#245;vξ'(id:839) from 74.115.3.64:51868
    	Line 11699: 2011-09-28 19:50:46.967408|INFO    |VirtualServer |  1| client disconnected 'Ľ&#243;Ť ļ&#245;vξ'(id:839) reason 'reasonmsg=leaving'
    	Line 11714: 2011-09-28 19:53:41.699095|INFO    |VirtualServer |  1| client connected '√ΐ๘Ŧ๑гצ'(id:839) from 149.255.255.60:63601
    	Line 11716: 2011-09-28 19:53:56.592935|INFO    |VirtualServer |  1| client disconnected '√ΐ๘Ŧ๑гצ'(id:839) reason 'reasonmsg=leaving'
    	Line 11736: 2011-09-28 19:57:58.994671|INFO    |VirtualServer |  1| client connected '√ΐ๘Ŧ๑гצ'(id:839) from 149.255.255.60:60162
    	Line 11740: 2011-09-28 19:58:17.897115|INFO    |VirtualServer |  1| client connected 'LOST LOVE'(id:839) from 149.255.221.134:61309
    	Line 11745: 2011-09-28 19:58:44.044048|INFO    |VirtualServer |  1| client connected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839) from 149.255.252.211:4036
    	Line 11828: 2011-09-28 20:16:04.392542|INFO    |VirtualServer |  1| client disconnected '√ΐ๘Ŧ๑гצ'(id:839) reason 'reasonmsg=connection lost'
    	Line 11831: 2011-09-28 20:16:17.119664|INFO    |VirtualServer |  1| client connected '√ΐ๘Ŧ๑гצ'(id:839) from 149.255.255.60:60162
    	Line 11856: 2011-09-28 20:18:36.301382|INFO    |VirtualServer |  1| client disconnected '√ΐ๘Ŧ๑гצ'(id:839) reason 'reasonmsg=leaving'
    	Line 11868: 2011-09-28 20:24:04.917904|INFO    |VirtualServer |  1| client connected '√ΐ๘Ŧ๑гצ'(id:839) from 149.255.255.60:61333
    	Line 11872: 2011-09-28 20:25:01.654428|INFO    |VirtualServer |  1| client disconnected '√ΐ๘Ŧ๑гצ'(id:839) reason 'reasonmsg=leaving'
    	Line 11875: 2011-09-28 20:25:35.179247|INFO    |VirtualServer |  1| client connected '√ΐ๘Ŧ๑гצ'(id:839) from 149.255.255.60:61335
    	Line 11915: 2011-09-28 20:32:53.482046|INFO    |VirtualServer |  1| client disconnected 'LOST LOVE'(id:839) reason 'reasonmsg=leaving'
    	Line 11959: 2011-09-28 20:36:49.957991|INFO    |VirtualServer |  1| channel 'RANGERz'(id:2469) created by '√ΐ๘Ŧ๑гצ'(id:839)
    	Line 11961: 2011-09-28 20:36:51.133606|INFO    |VirtualServer |  1| client connected 'LOST LOVE'(id:839) from 149.255.228.110:51435
    	Line 12014: 2011-09-28 20:40:51.593952|INFO    |VirtualServer |  1| client disconnected '√ΐ๘Ŧ๑гצ'(id:839) reason 'reasonmsg=leaving'
    	Line 12015: 2011-09-28 20:40:51.957174|INFO    |VirtualServer |  1| client disconnected 'LOST LOVE'(id:839) reason 'reasonmsg=leaving'
    	Line 12067: 2011-09-28 20:48:34.023219|INFO    |VirtualServer |  1| client connected '.                   .'(id:839) from 149.255.255.60:63601
    	Line 12068: 2011-09-28 20:48:37.502480|INFO    |VirtualServer |  1| client disconnected '.                   .'(id:839) reason 'reasonmsg=leaving'
    	Line 12128: 2011-09-28 20:57:41.420285|INFO    |VirtualServer |  1| client connected 'LOST LOVE'(id:839) from 149.255.228.110:54229
    	Line 12131: 2011-09-28 20:57:57.684316|INFO    |VirtualServer |  1| client connected '√ΐ๘Ŧ๑гצ'(id:839) from 149.255.255.60:50925
    	Line 12161: 2011-09-28 21:02:54.076459|INFO    |VirtualServer |  1| client disconnected 'śŦ&#161;ήĜ&#233;Ř'(id:839) reason 'reasonmsg=leaving'
    	Line 12162: 2011-09-28 21:03:14.624199|INFO    |VirtualServer |  1| client connected '_                      _'(id:839) from 149.255.255.60:64688
    	Line 12196: 2011-09-28 21:10:11.589518|INFO    |VirtualServer |  1| client 'Ъŀ&#211;ŏĎ'(id:839) was added to channelgroup 'Guest'(id:8) by client '>Ts<Silent Killer'(id:366) in channel '<---------Pro\(>TS<)/Assasin's-->MW2'(id:491)
    	Line 12197: 2011-09-28 21:10:11.591029|INFO    |VirtualServer |  1| client '√ΐ๘Ŧ๑гצ'(id:839) was added to channelgroup 'Guest'(id:8) by client '>Ts<Silent Killer'(id:366) in channel '<--------->T.E.A.M_S.T.R.I.K.E.<------->'(id:31)
    	Line 12201: 2011-09-28 21:10:37.101203|INFO    |VirtualServer |  1| client (id:839) was added to servergroup 'زبالة - Trashcan'(id:118) by client 'Ahmed'(id:2)
    	Line 12202: 2011-09-28 21:10:53.346684|INFO    |VirtualServer |  1| client (id:839) was added to servergroup 'LoL'(id:13) by client '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839)
    	Line 12202: 2011-09-28 21:10:53.346684|INFO    |VirtualServer |  1| client (id:839) was added to servergroup 'LoL'(id:13) by client '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839)
    	Line 12203: 2011-09-28 21:10:53.994486|INFO    |VirtualServer |  1| client (id:839) was removed from servergroup 'CoD4'(id:12) by client 'Ahmed'(id:2)
    	Line 12204: 2011-09-28 21:11:01.854657|INFO    |VirtualServer |  1| client (id:839) was added to servergroup 'Server Admin'(id:6) by client '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839)
    	Line 12204: 2011-09-28 21:11:01.854657|INFO    |VirtualServer |  1| client (id:839) was added to servergroup 'Server Admin'(id:6) by client '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839)
    	Line 12205: 2011-09-28 21:11:11.480092|INFO    |VirtualServer |  1| client (id:839) was removed from servergroup 'Server Admin'(id:6) by client '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839)
    	Line 12205: 2011-09-28 21:11:11.480092|INFO    |VirtualServer |  1| client (id:839) was removed from servergroup 'Server Admin'(id:6) by client '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839)
    	Line 12206: 2011-09-28 21:11:14.313043|INFO    |VirtualServer |  1| client 'Ahmed'(id:2) was added to channelgroup 'Channel Admin'(id:5) by client '√ΐ๘Ŧ๑гצ'(id:839) in channel '₪₪₪₪ Admin Zone ₪₪₪₪'(id:2)
    	Line 12207: 2011-09-28 21:11:16.452680|INFO    |VirtualServer |  1| client disconnected 'Ъŀ&#211;ŏĎ'(id:839) reason 'invokerid=61 invokername=Ahmed invokeruid=eUiAoXTTVq+ZJvpLzOOtOdVkDVQ= reasonmsg bantime=0'
    	Line 12211: 2011-09-28 21:11:47.402654|INFO    |VirtualServer |  1| client disconnected '√ΐ๘Ŧ๑гצ'(id:839) reason 'invokerid=61 invokername=Ahmed invokeruid=eUiAoXTTVq+ZJvpLzOOtOdVkDVQ= reasonmsg bantime=0'
    	Line 12227: 2011-09-28 21:13:04.145456|INFO    |VirtualServer |  1| client disconnected '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839) reason 'invokerid=61 invokername=Ahmed invokeruid=eUiAoXTTVq+ZJvpLzOOtOdVkDVQ= reasonmsg bantime=0'
    	Line 12234: 2011-09-28 21:15:52.887730|INFO    |VirtualServer |  1| client (id:839) was removed from servergroup 'LoL'(id:13) by client 'Ahmed'(id:2)
    any idea? please its a public server cant lock it with password ..

    AFTER this issue i did a permrest and rested all permissions to default

    so please advice how did he get the powers?

    how he added him self to server group LoL in first place ?
    Code:
    client (id:839) was added to servergroup 'LoL'(id:13) by client '♫< X.๖ۣۜS&#169;Ǿ&#174;๖ۣۜPiǾ๖ۣۜN > &#165;♫'(id:839)
    this group is only LoL game icon copy of normal group WITH icon

    I ADDED him to group trashcan which is noob group with no move, join, talk, poke powers for the annoying users

    so ? how he got this power and got server admin?

    please advice
    thx

  2. #2
    Join Date
    June 2008
    Posts
    18,513
    1. Try to ban his Ip or his IP range 149.255.192.0 - 149.255.255.255,
    but this bans everyone from EarthLink Ltd. Communications&Internet Services

    The ban should look like 149.255.((19[2-9])|(2[0-5][0-9])).* as an regular expresion.

    2. Check that enough i_group_needed_member_add_power is set on your LoL group.
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  3. #3
    Join Date
    June 2011
    Location
    Baghdad, Iraq
    Posts
    367
    1- WONT work since our server is free for Iraqi users to help them and 98% of them are from that ISP and range

    2- i did and i set it myself its 100% clean just a copy of the "normal" group

    :/..

    ok what am doing right now is
    - did a permrest rested all server permissions
    - installed a bot with protected server groups feature
    - limited guest powers as much as possible
    - limited clone allowed per uid to 1

    now i would like to know is it possible to limit connections per IP ? maybe via iptables ? would that work ?
    anything else i can do?
    Last edited by Ahmed; September 29th, 2011 at 05:29 PM.

  4. #4
    Join Date
    June 2008
    Posts
    18,513
    Sure you can restrict the connection, but this has nothing to do with teamspeak.
    http://www.cyberciti.biz/faq/iptable...-limits-howto/
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  5. #5
    Join Date
    June 2011
    Location
    Baghdad, Iraq
    Posts
    367
    i know i can do it with iptables but what i need to know is this method effective on teamspeak server?
    if yes then what is the best settings to use for public server?

  6. #6
    Join Date
    June 2008
    Posts
    18,513
    The method is effective for every tools/server that is running on your machine, but it also blockes the conenction from others. When he does change his IP that often. Because you have to add all his IP's and at the end a range ban would be the most effective weapon.
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Security Breach
    By bmth0msen in forum General Questions
    Replies: 0
    Last Post: August 26th, 2015, 03:02 AM
  2. Cleaning A Server Permissions Breach
    By ktx2skd in forum Permission System
    Replies: 3
    Last Post: December 30th, 2011, 07:42 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •