Security Incidents mailing list archives
Re: SSH attacks?
From: buzz <reitenba () fh-brandenburg de>
Date: Tue, 27 Jul 2004 23:12:04 +0200
On Tuesday 27 July 2004 00:59, Robin wrote:
Looking a bit closer (and in other log files), I see it's people trying random accounts. The big ones are going over a large list, the pairs seem to be just hitting test and guest: Jul 26 23:05:59 kallisti sshd[12314]: Illegal user test from ::ffff:64.246.56.44 Jul 26 23:05:59 kallisti sshd[12314]: Failed password for illegal user test from ::ffff:64.246.56.44 port 41920 ssh2 Jul 26 23:06:01 kallisti sshd[12320]: Illegal user guest from ::ffff:64.246.56.44 Jul 26 23:06:01 kallisti sshd[12320]: Failed password for illegal user guest from ::ffff:64.246.56.44 port 41967 ssh2 Does anyone know why this would appear all of a sudden?
there is a thread on full-disclosure covering these ssh login attempts. someone gave a link to the following site: http://www.dslreports.com/forum/remark,10854834~mode=flat~days=9999 buzz
Current thread:
- Re: SSH attacks?, (continued)
- Re: SSH attacks? Pieter-Bas IJdens (Jul 29)
- Re: SSH attacks? Christine Kronberg (Jul 29)
- Re: SSH attacks? Pieter-Bas IJdens (Jul 30)
- Re: SSH attacks? Frank Knobbe (Jul 30)
- Re: SSH attacks? Jay D. Dyson (Jul 30)
- Re: SSH attacks? Frank Knobbe (Jul 31)
- Re: SSH attacks? mgotts (Jul 31)
- Re: SSH attacks? Steve Schuster (Jul 29)
- Re: SSH attacks? Merlijn Tishauser (Jul 30)
- Re: SSH attacks? Jyri Hovila (Jul 29)
- Re: SSH attacks? Chris Brenton (Jul 29)
- Re: SSH attacks? Valdis . Kletnieks (Jul 30)
- Re: SSH attacks? Thomas Hochstein (Jul 30)
- Re: SSH attacks? Matt Beland (Jul 30)
- Re: SSH attacks? Jyri Hovila (Jul 29)
- Re: SSH attacks? Andrew J Caines (Jul 29)