seandex
I spot something in the log
---------------------------------
2019-01-08 08:53:08-0800 [-] VPN Auth Failed: 'DEFAULT_USER6: IP6 address pool depleted: omi/auth:546,internet/defer:746,sagent/user
svc:1295,sagent/usersvc:615,sagent/usersvc:145,sagent/usersvc:270,sagent/usersvc:228,sagent/usersvc:209,<string>:1,sagent/sagent_ent
ry:17,util/mycprof:11,<string>:1,sagent/sagent_entry:14,sagent/sagent_entry:11,util/daemon:28,util/daemon:69,application/app:423,scr
ipts/_twistd_unix:202,application/app:445,application/app:348,internet/base:1166,internet/base:1175,internet/base:779,util/defer:195
,internet/defer:829,internet/defer:746,sagent/usersvc:1295,sagent/usersvc:615,sagent/usersvc:145,sagent/usersvc:270,sagent/usersvc:2
28,sagent/usersvc:209,util/error:61,util/error:44 (VPN_AUTH)' [None]
and keys that i never seen before added as below
------------------------------------------------------------
"ip6tables.vpn.disable.filter": "true"
"ip6tables.vpn.disable.mangle": "true"
"vpn.routing6.enable": "true"
"vpn.server.daemon.vpn_network6.0": "fd4a:xxx:xxxxxxxxxxxxxx"
"vpn.server.nat6": "false"
:o
The Johan
Well, if you didn't do that, somebody did. But the error message itself doesn't mean you've been hacked, it's just an error message. But if you didn't make these changes, then somebody else did, and that might be an indication that "you got hacked".
