Re: Ongoing distributed Linux SSH dictionary attack

[Ken Connelly <Ken.Connelly () UNI EDU>]

Pete Hickey wrote:
> On Thu, Apr 16, 2009 at 04:15:00PM -0700, Andrew Daviel wrote:
>
> > FYI
> >
> > We are seeing a distributed-source SSH dictionary attack on multiple
> > machines. The sources appear to be running Linux according to P0F. This
> > blows past our "15 strikes sitewide and you are out" filter.
>
> We're seeing a large increase of ssh dictionary attacks this week.  Although
> it's coming from a number of different machines, I wouldn't call it a large
> enough number to consider it a distributed attack.
We've been seeing this pretty consistently for about 10 days although
the rate has fluctuated some.  I've seen about 1400 different source
addresses here.

--
- Ken
=================================================================
Ken Connelly             Associate Director, Security and Systems
ITS Network Services                  University of Northern Iowa
email: Ken.Connelly () uni edu   p: (319) 273-5850 f: (319) 273-7373