Re: SSH dictionary attack dictionary

[John Kristoff <jtk () DEPAUL EDU>]

On Mon, Aug 10, 2009 at 03:57:49PM -0700, Andrew Daviel wrote:
> Ever wondered what passwords those annoying SSH dictionary attacks were
> trying ? At some point I modified sshd to collect failed passwords.
>
> In 2006 I saw some 200 attempts against root and basically 1 each against
> a "baby's first name" list with username=password.

Hi Andre.  I've been involved in a project that has been doing this
too (among other things).  I've seen brute force attempts from a single
host lasting more than a day and many of the passwords have not been
dictionary words.  I hope people pay attention to this, because it
really does elevate the benefit of avoiding passwords (I use keys
myself, but I know its not always easy for the average user).

> Recently I saw some 600 against root, and a dozen each against other
> common accounts like "sales", "helpdesk" etc.

Only 600?  :-)

FYI you may be interested in this:

  <http://sock-raw.org/papers/openssh_library>

John