Looking at the security logs I saw a new ... / 2008-10-01

2008-10-01 Looking at the security logs I saw a new ... 11 years ago
Looking at the security logs I saw a new kind of distributed ssh attack. Not the usual dictionary of common login names but a start at
Sep 30 19:13:06 idefix sshd[99210]: Illegal user aaa from 67.152.2.17
Sep 30 19:13:06 idefix sshd[99210]: Failed unknown for illegal user aaa from 67. 152.2.17 port 36709 ssh2
Slowly but surely working towards
Oct  1 11:30:20 idefix sshd[32699]: Illegal user asn from 196.211.228.226
Oct  1 11:30:21 idefix sshd[32699]: Failed unknown for illegal user asn from 196.211.228.226 port 58586 ssh2
With a bit of grep and awk later I found 174 attempts like this (3 letter account names) from 102 IPs. Now all added to the firewalling rules.

The complete list of source IPs attacking ssh

Update 2008-10-01: still going strong: 211 attempts from 126 IP addresses. Firewall rules updated. List updated.

Tags: ,

, reachable as koos+website@idefix.net. PGP encrypted e-mail preferred.

PGP key 5BA9 368B E6F3 34E4 local copy PGP key 5BA9 368B E6F3 34E4 via keyservers pgp key statistics for 0x5BA9368BE6F334E4 Koos van den Hout
RSS
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews
This page generated in 0.004168 seconds.