Distributed Bruteforce against SSH

[Gary Baribault <gary () baribault net>]

I guess what I reported last week was the warmup round .. Where now 
getting thousands of attemped logins with the standars dictionary of 
potential login names.

As I stated, I'm not interested in avoiding these attacks, so please 
don't sugges that I change the SSH port, my machines are safe enough ..

For those who missed it, I have three servers on the Internet, two cable 
modems and one static and again, two of them are getting about 100 
attacks per hour but instead of using Root for every attempt, we are now 
seeing the standars alphabetical list of users.

What wories me is all of the Linux/Unix servers out there (and I guess 
to a lesser degree Windows boxes with an SSH Daemon) that have many 
normal remote users who are allowed remote access with SSH and have weak 
passwords.

This attack seems to be aimed at them, and will certainly succeed.

See a sample of one of my logs below

Gary B

messages:May 11 21:59:39 salle sshd[5493]: Invalid user a'marie from 
213.251.185.54
messages:May 11 21:59:39 salle sshd[5493]: Failed 
keyboard-interactive/pam for invalid user a'marie from 213.251.185.54 
port 33943 ssh2
messages:May 11 22:01:34 salle sshd[5519]: Invalid user aaliyah from 
62.206.228.188
messages:May 11 22:01:34 salle sshd[5519]: Failed 
keyboard-interactive/pam for invalid user aaliyah from 62.206.228.188 
port 49207 ssh2
messages:May 11 22:03:11 salle sshd[5524]: Invalid user aaralyn from 
212.220.166.26
messages:May 11 22:03:11 salle sshd[5524]: Failed 
keyboard-interactive/pam for invalid user aaralyn from 212.220.166.26 
port 1408 ssh2
messages:May 11 22:04:05 salle sshd[5528]: Invalid user aaron from 
83.151.29.86
messages:May 11 22:04:05 salle sshd[5528]: Failed 
keyboard-interactive/pam for invalid user aaron from 83.151.29.86 port 
55756 ssh2
messages:May 11 22:05:34 salle sshd[5533]: Invalid user abbie from 
70.43.165.34
messages:May 11 22:05:34 salle sshd[5533]: Failed 
keyboard-interactive/pam for invalid user abbie from 70.43.165.34 port 
48681 ssh2
messages:May 11 22:06:41 salle sshd[5537]: Invalid user abbott from 
194.204.62.2
messages:May 11 22:06:41 salle sshd[5537]: Failed 
keyboard-interactive/pam for invalid user abbott from 194.204.62.2 port 
7799 ssh2
messages:May 11 22:08:33 salle sshd[5543]: Invalid user abdukrahman from 
62.206.22.124
messages:May 11 22:08:34 salle sshd[5543]: Failed 
keyboard-interactive/pam for invalid user abdukrahman from 62.206.22.124 
port 50525 ssh2
messages:May 11 22:12:11 salle sshd[5558]: Invalid user abdulrahman from 
196.211.191.58
messages:May 11 22:12:12 salle sshd[5558]: Failed 
keyboard-interactive/pam for invalid user abdulrahman from 
196.211.191.58 port 58081 ssh2
messages:May 11 22:12:55 salle sshd[5562]: Invalid user abe from 
217.172.164.130
messages:May 11 22:12:55 salle sshd[5562]: Failed 
keyboard-interactive/pam for invalid user abe from 217.172.164.130 port 
56462 ssh2
messages:May 11 22:13:53 salle sshd[5566]: Invalid user abel from 
80.68.94.169
messages:May 11 22:13:54 salle sshd[5566]: Failed 
keyboard-interactive/pam for invalid user abel from 80.68.94.169 port 
2229 ssh2
messages:May 11 22:15:47 salle sshd[5592]: Invalid user abia from 
86.49.7.207
messages:May 11 22:15:47 salle sshd[5592]: Failed 
keyboard-interactive/pam for invalid user abia from 86.49.7.207 port 
1407 ssh2
messages:May 11 22:16:32 salle sshd[5595]: Invalid user abiba from 
200.117.122.206
messages:May 11 22:16:33 salle sshd[5595]: Failed 
keyboard-interactive/pam for invalid user abiba from 200.117.122.206 
port 53258 ssh2
messages:May 11 22:18:02 salle sshd[5599]: Invalid user abie from 
208.189.14.194
messages:May 11 22:18:02 salle sshd[5599]: Failed 
keyboard-interactive/pam for invalid user abie from 208.189.14.194 port 
36420 ssh2
messages:May 11 22:18:24 salle sshd[5602]: Invalid user abigail from 
69.128.70.86
messages:May 11 22:18:25 salle sshd[5602]: Failed 
keyboard-interactive/pam for invalid user abigail from 69.128.70.86 port 
3154 ssh2
messages:May 11 22:19:53 salle sshd[5605]: Invalid user abner from 
62.147.203.49
messages:May 11 22:19:53 salle sshd[5605]: Failed 
keyboard-interactive/pam for invalid user abner from 62.147.203.49 port 
38321 ssh2
messages:May 11 22:20:17 salle sshd[5608]: Invalid user abra from 
61.29.122.140
messages:May 11 22:20:17 salle sshd[5609]: input_userauth_request: 
invalid user abra
messages:May 11 22:20:17 salle sshd[5608]: Failed 
keyboard-interactive/pam for invalid user abra from 61.29.122.140 port 
53367 ssh2
messages:May 11 22:20:57 salle sshd[5612]: Invalid user abra from 
200.166.58.108
messages:May 11 22:20:58 salle sshd[5612]: Failed 
keyboard-interactive/pam for invalid user abra from 200.166.58.108 port 
41499 ssh2
messages:May 11 22:21:28 salle sshd[5615]: Invalid user abraham from 
82.193.22.18
messages:May 11 22:21:28 salle sshd[5616]: input_userauth_request: 
invalid user abraham
messages:May 11 22:21:28 salle sshd[5615]: Failed 
keyboard-interactive/pam for invalid user abraham from 82.193.22.18 port 
33116 ssh2
messages:May 11 22:22:36 salle sshd[5619]: Invalid user abram from 
66.159.198.155
messages:May 11 22:22:37 salle sshd[5619]: Failed 
keyboard-interactive/pam for invalid user abram from 66.159.198.155 port 
45869 ssh2
messages:May 11 22:22:53 salle sshd[5622]: Invalid user abram from 
89.110.144.212
messages:May 11 22:22:53 salle sshd[5623]: input_userauth_request: 
invalid user abram
messages:May 11 22:22:53 salle sshd[5622]: Failed 
keyboard-interactive/pam for invalid user abram from 89.110.144.212 port 
35527 ssh2
messages:May 11 22:23:29 salle sshd[5625]: Invalid user abrianna from 
204.13.164.75
messages:May 11 22:23:29 salle sshd[5625]: Failed 
keyboard-interactive/pam for invalid user abrianna from 204.13.164.75 
port 36896 ssh2
messages:May 11 22:24:22 salle sshd[5629]: Invalid user abrienda from 
87.234.200.80
messages:May 11 22:24:22 salle sshd[5629]: Failed 
keyboard-interactive/pam for invalid user abrienda from 87.234.200.80 
port 17603 ssh2
messages:May 11 22:25:04 salle sshd[5632]: Invalid user abrienda from 
168.234.199.84
messages:May 11 22:25:04 salle sshd[5632]: Failed 
keyboard-interactive/pam for invalid user abrienda from 168.234.199.84 
port 47504 ssh2
messages:May 11 22:25:52 salle sshd[5635]: Invalid user abril from 
83.246.96.70
messages:May 11 22:25:52 salle sshd[5635]: Failed 
keyboard-interactive/pam for invalid user abril from 83.246.96.70 port 
48594 ssh2
messages:May 11 22:25:55 salle sshd[5638]: Invalid user abril from 
62.2.99.174
messages:May 11 22:25:56 salle sshd[5638]: Failed 
keyboard-interactive/pam for invalid user abril from 62.2.99.174 port 
1424 ssh2
messages:May 11 22:27:00 salle sshd[5642]: Invalid user absolom from 
200.117.122.206
messages:May 11 22:27:01 salle sshd[5642]: Failed 
keyboard-interactive/pam for invalid user absolom from 200.117.122.206 
port 45918 ssh2
messages:May 11 22:27:15 salle sshd[5645]: Invalid user abu from 
85.14.219.67
messages:May 11 22:27:15 salle sshd[5645]: Failed 
keyboard-interactive/pam for invalid user abu from 85.14.219.67 port 
38085 ssh2
messages:May 11 22:28:48 salle sshd[5649]: Invalid user acacia from 
64.83.58.161
messages:May 11 22:28:48 salle sshd[5649]: Failed 
keyboard-interactive/pam for invalid user acacia from 64.83.58.161 port 
39750 ssh2
messages:May 11 22:30:48 salle sshd[5675]: Invalid user ace from 
61.29.122.140
messages:May 11 22:30:48 salle sshd[5676]: input_userauth_request: 
invalid user ace
messages:May 11 22:30:48 salle sshd[5675]: Failed 
keyboard-interactive/pam for invalid user ace from 61.29.122.140 port 
60660 ssh2
messages:May 11 22:32:25 salle sshd[5680]: Invalid user acton from 
217.98.80.5
messages:May 11 22:32:25 salle sshd[5680]: Failed 
keyboard-interactive/pam for invalid user acton from 217.98.80.5 port 
10497 ssh2
messages:May 11 22:32:57 salle sshd[5683]: Invalid user acton from 
88.198.47.143
messages:May 11 22:32:57 salle sshd[5683]: Failed 
keyboard-interactive/pam for invalid user acton from 88.198.47.143 port 
39369 ssh2
messages:May 11 22:33:21 salle sshd[5686]: Invalid user ada from 
200.74.136.246
messages:May 11 22:33:21 salle sshd[5686]: Failed 
keyboard-interactive/pam for invalid user ada from 200.74.136.246 port 
35651 ssh2
messages:May 11 22:33:51 salle sshd[5689]: Invalid user ada from 
69.15.102.215
messages:May 11 22:33:51 salle sshd[5689]: Failed 
keyboard-interactive/pam for invalid user ada from 69.15.102.215 port 
50657 ssh2
messages:May 11 22:34:57 salle sshd[5693]: Invalid user adah from 
216.197.204.76
messages:May 11 22:34:57 salle sshd[5693]: Failed 
keyboard-interactive/pam for invalid user adah from 216.197.204.76 port 
43581 ssh2
messages:May 11 22:35:17 salle sshd[5696]: Invalid user adair from 
76.160.167.251
messages:May 11 22:35:17 salle sshd[5696]: Failed 
keyboard-interactive/pam for invalid user adair from 76.160.167.251 port 
50495 ssh2
messages:May 11 22:38:36 salle sshd[5715]: Invalid user adamina from 
201.21.210.151
messages:May 11 22:38:36 salle sshd[5716]: input_userauth_request: 
invalid user adamina
messages:May 11 22:38:37 salle sshd[5715]: Failed 
keyboard-interactive/pam for invalid user adamina from 201.21.210.151 
port 34881 ssh2
messages:May 11 22:38:54 salle sshd[5718]: Invalid user adamina from 
133.6.61.76
messages:May 11 22:38:54 salle sshd[5718]: Failed 
keyboard-interactive/pam for invalid user adamina from 133.6.61.76 port 
44428 ssh2
messages:May 11 22:39:29 salle sshd[5721]: Invalid user adamma from 
212.51.52.244
messages:May 11 22:39:29 salle sshd[5721]: Failed 
keyboard-interactive/pam for invalid user adamma from 212.51.52.244 port 
41180 ssh2
messages:May 11 22:39:51 salle sshd[5724]: Invalid user adamma from 
83.244.156.204
messages:May 11 22:39:51 salle sshd[5724]: Failed 
keyboard-interactive/pam for invalid user adamma from 83.244.156.204 
port 50954 ssh2
messages:May 11 22:41:02 salle sshd[5735]: Invalid user adara from 
88.198.47.143
messages:May 11 22:41:02 salle sshd[5735]: Failed 
keyboard-interactive/pam for invalid user adara from 88.198.47.143 port 
33031 ssh2
messages:May 11 22:42:28 salle sshd[5738]: Invalid user addison from 
62.2.211.46
messages:May 11 22:42:28 salle sshd[5738]: Failed 
keyboard-interactive/pam for invalid user addison from 62.2.211.46 port 
29580 ssh2