Re: Anyone else seeing SSH scans?

[Charles Heselton <charles.heselton () gmail com>]

On Tue, 27 Jul 2004 10:00:24 -0700, Matthew Dharm
<mdharm () one-eyed-alien net> wrote:
> I've noticed that several *NIX machines I have running (all of which are
> located in the same IP block) are periodically getting scanned via ssh for
> the accounts 'test' and 'guest'.
>
> The source IP varies with each scan.  But I'm getting about one of these a
> day now.  Obviously, I don't have accounts with that name on my systems,
> but still....
>
> Is this something new, or just people looking for badly configured
> machines?
>
> Matt
>
> --
> Matthew Dharm                              Home: mdharm () one-eyed-alien net
> Senior Software Designer, Momentum Computer
>
> P:  Nine more messages in admin.policy.
> M: I know, I'm typing as fast as I can!
>                                        -- Pitr and Mike
> User Friendly, 11/27/97
Most likely the latter.  I haven't heard of any new SSH exploits since
the last batch.  As long as you're up to date, I would suspect that
you're fine.

-- 
Charlie Heselton
Network Security Engineer