Security Incidents mailing list archives

Re: More ssh attempts

From: Homer Wilson Smith <homer () lightlink com>
Date: Thu, 22 Nov 2001 19:46:20 -0500 (EST)

On Thu, Nov 22, 2001 at 11:24:43AM +0200, Marco Slaviero wrote:

The user has restricted (sftp, and a change passwd script) access to the box.
It does not seem to be the crc32 attack. The user logged on about 136 time in
an hour, and disconnected almost immediately. Anyone seen this before?


    I got 30 or more 'simultaneous' hits from one IP this afternoon
driving load to 76 on a SunOS server.

    Homer


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Current thread:

MSLV.exe Rob Keown (Nov 21)
- <Possible follow-ups>
- RE: MSLV.exe Rob Keown (Nov 21)
  - More ssh attempts Marco Slaviero (Nov 22)
    - Re: More ssh attempts gabriel rosenkoetter (Nov 22)
    - Re: More ssh attempts Homer Wilson Smith (Nov 22)
    - Re: More ssh attempts Marco Slaviero (Nov 23)