Editing Tornedo.tetrain.com Upgrade Plan (section)

=== 10.3 Still open — this is very likely fleet-wide, not just <code><nowiki>relay.isgec.com</nowiki></code> ===

The <code><nowiki>admin</nowiki></code> lockout was also triggered from <code><nowiki>upyog.tetrain.com</nowiki></code> and <code><nowiki>mail.sceh.net</nowiki></code> — strongly suggesting the same exposure (no fail2ban, password auth enabled) exists on other boxes too. '''Not yet swept.''' Recommended next steps whenever picked back up:

# Check <code><nowiki>fail2ban</nowiki></code> presence + <code><nowiki>PasswordAuthentication</nowiki></code> setting across the rest of the reachable fleet, same two checks used on <code><nowiki>relay.isgec.com</nowiki></code>.
# Install/configure fail2ban (with the same VPN whitelist) on every exposed box found.
# Longer-term: consider disabling SSH password auth fleet-wide in favor of key-only, which removes this attack surface entirely rather than just rate-limiting it.
# The disabled <code><nowiki>arun</nowiki></code> account being targeted specifically suggests old/leaked credentials are circulating — worth a broader check for any other long-disabled accounts that might be similarly targeted, and confirming they're all properly locked (not just disabled at the OS level but also <code><nowiki>nsAccountLock: TRUE</nowiki></code> in IPA, as <code><nowiki>arun</nowiki></code> correctly was).