Looking at the security logs I saw a new ... / 2008-10-01

2008-10-01 Looking at the security logs I saw a new ...
Looking at the security logs I saw a new kind of distributed ssh attack. Not the usual dictionary of common login names but a start at
Sep 30 19:13:06 idefix sshd[99210]: Illegal user aaa from 67.152.2.17
Sep 30 19:13:06 idefix sshd[99210]: Failed unknown for illegal user aaa from 67. 152.2.17 port 36709 ssh2
Slowly but surely working towards
Oct  1 11:30:20 idefix sshd[32699]: Illegal user asn from 196.211.228.226
Oct  1 11:30:21 idefix sshd[32699]: Failed unknown for illegal user asn from 196.211.228.226 port 58586 ssh2
With a bit of grep and awk later I found 174 attempts like this (3 letter account names) from 102 IPs. Now all added to the firewalling rules.

The complete list of source IPs attacking ssh

Update 2008-10-01: still going strong: 211 attempts from 126 IP addresses. Firewall rules updated. List updated.

Tags: ,

IPv6 check

Running test...
, reachable as koos+website@idefix.net. PGP encrypted e-mail preferred. PGP key 5BA9 368B E6F3 34E4 local copy PGP key 5BA9 368B E6F3 34E4 via keyservers

RSS
Meningen zijn die van mezelf, wat ik schrijf is beschermd door auteursrecht. Sommige publicaties bevatten een expliciete vermelding dat ze ongevraagd gedeeld mogen worden.
My opinions are my own, what I write is protected by copyrights. Some publications contain an explicit license statement which allows sharing without asking permission.
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews
This page generated by $Id: newsitem.cgi,v 1.55 2021/11/09 13:09:49 koos Exp $ in 0.005106 seconds.