Disconect telnet user

[Smudge1977]

Hi

Just did a show user on an external router

There was listed a session from 221.191.242.50 that had been idle for 2 weeks!!! Okay so lets kill the session:

clear line vty 3

Show user

Dam user is still there idle!! The other interesting thing is that the IP address is registered in Japan - nothing to do with me!! So a) why can't I clear there session, b) how is it anyway - get off my router!!!!

Thanks

 

[plshlpme]

do you not have an access-list on your vtys?

 

[vipergg]

You should also have exec-timeouts on your vty sessions of like 15 minutes so that it will drop the session after inactivity . ACL's on your vty's is good security practice .

 

[Smudge1977]

it does have exec-timeouts but no acls at the moment your right

it is in a sort of honey pot sat on the edge of my network outside the f/w!

could reload the router - nice and easy but its not even like they are doing anything aparently it has been idle for 4 weeks!!!

While grag anything from the syslog server and post it up.

 

[Smudge1977]

humm - that was exciting lol they only go back 5 days!