Hello,
Today I'm going to share with you when illegal attacks cause OLT equipment to be out of control.
Fault description:
The user remotely logs in to the OLT device and prompts "too many users", and the login cannot be successful.
Troubleshooting process:
1- Use the display client command or the display terminal user online command to view the operating user information. It is found that no other users are online except for the serial port user.
2- Through collecting information, it is found that there are some fixed IPs that keep trying to log in to port 22 of the OLT (SSH uses port 22, Telnet uses port 23, sharing the connection channel, and SSH is recommended). Because these IPs are not owned by the operator, there are viruses. Or the possibility of malicious attacks on the OLT. At the same time, the problem sites of several operators do not have any security measures, ACL/firewall is not configured, and the default password of root has not been modified.
3- When the OLT faces such malicious attacks, if there is no firewall defense, the internal protection of abnormal TCP connections is insufficient. If terminal user 1 just closes the connection, user 2 connects again (thousands of connections in a short period of time can easily reproduce the problem), user 2 and user 1 will be assigned to use the same connection channel, causing user 2 to close the connection abnormally failure. In this way, the conflicts accumulate to a certain extent, and the user cannot log in normally.
4- You can use the existing powerful firewall and ACL rules of the OLT to solve this problem. The command is as follows:
Command:
firewall enable
acl 3000
rule permit tcp source 192.168.109.0 0.0.0.255 destination 192.168.109.100 0
rule deny tcp source any destination 192.168.253.15 0
firewall packet-filter 3000 inbound
Problem review:
If the OLT is running well, simply perform the above configuration; if the OLT site has already displayed the "too many users" prompt and cannot log in, it is recommended to "reset the system first, configure the above ACL, and finally save" "First configure the above ACL, then save, and finally reset the system" steps to troubleshoot.
You are welcome to leave a message and exchange in the comment area. Thank you!
