Re: Uptick in SSH attempts; anyone else ?

["Lorenz, Eva" <evalorenz () UNC EDU>]

We had an increased number of SSH attempts over the weekend, starting late Friday night.
Fri to Sat IPs from European countries, a lot of German IPs, then also some US, China, Brazil and Russia
Sat to Sunday Germany, Russia and Brazil

 - Eva

________________________________________
From: The EDUCAUSE Security Constituent Group Listserv [SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Andrew Daviel 
[advax () TRIUMF CA]
Sent: Monday, January 18, 2010 2:16 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Uptick in SSH attempts; anyone else ?

We monitor and block attempts to brute-force SSH logins.
Usually we block a few a day, with at most about 60.

Over the weekend we had a spike of over 500. I.e. 500 separate source addresses
trying to login to multiple accounts/machines using 1000 different IDs.

Anyone else seen this, or is it just us ?

(BTW, my previous collection of attempted ID/passwords - from a hacked
sshd - is at http://andrew.triumf.ca/ssh_pass_file2.html )

--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376  (Pacific Time)
Network Security Manager