Re: SSH attacks?

[Paul Schmehl <pauls () utdallas edu>]

--On Tuesday, July 27, 2004 10:59:07 AM +1200 Robin <robin () kallisti net nz> 
wrote:
> While looking through the logs after someone ran over my system with
> Nessus, I  noticed some odd ones from sshd (that don't seem to be related
> to the nessus  scan):
> Jul 27 03:12:25 kallisti sshd[16471]: error: Could not get shadow
> information  for NOUSER
>
> Does anyone know why this would appear all of a sudden?

Yes.  These are compromised hosts that are being used to probe for 
vulnerable versions of sshd.  The login is irrelevant.  The banner tells 
they what they need to know.

You're not alone.  We're seeing them regularly.  And reporting them.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/