hi. i am totally loving my linode, and have no complaint at all. but i do have a question: why do i have up to a dozen 'guests' regularly viewing my forum, all with ip addys resolving to various linodes, ie li205-113.members.linode.com?

those guests seem like there connections coming from fellow linoders.. so i guess there are a few possible reasons.
1. Theyre using their linode to surf your forum
2. Their linode has been compromised and its scanning yours.
3. Its a TOR exit node or something simular and your visiters are coming from them..

Or a combination of the above

_________________
ServerAdmin - www.our-lan.com
"Diplomacy is the art of saying nice doggy whilst looking for a really big stick"
"In my experiece, any attempt to make any system idiot proof will only challenge God to make a better idiot"

#1 isn't such a strange case, BTW. Many people set up a proxy or VPN on their Linode for when they have to use some insecure hotel WiFi or whatever. (Or to get around Hulu/BBC location restrictions!)

(I'm doing it right now, but I don't use the default rDNS. )

_________________
Matt Nordhoff (aka Peng on IRC)

i dunno. i reckon its pretty suss that a full 1/3 of my visitors are using linode. especially considering they were not prior to me moving to linode.

By any chance do you have a private ip? I've seen nodes on various vps providers scan the private network.

_________________
Paid support
How to ask for help
1. Give details of your problem
2. Post any errors
3. Post relevant logs.
4. Don't hide details i.e. your domain, it just makes things harder
5. Be polite or you'll be eaten by a grue

i have no idea whether i have a private ip, so probably not
i am thinking to give all *.members.linode.com a 403.

I wouldn't bother if someone was that interested in causing you trouble they can just sign up else where.

You're better off installing something like fail2ban http://library.linode.com/security/fail2ban/

_________________
Paid support
How to ask for help
1. Give details of your problem
2. Post any errors
3. Post relevant logs.
4. Don't hide details i.e. your domain, it just makes things harder
5. Be polite or you'll be eaten by a grue

i have ssh locked down already. im not really worried about this from a security standpoint, im more annoyed about what is happening to my stats logging and whatnot.

What user agent are they using? What pages are they hitting? It's tough to speculate without more information. I'd say it's weird behavior, and I haven't seen it happen before.

_________________

/* TODO: need to add signature to posts */