Re: SSH attacks?

[Tom Laermans <tom.laermans () powersource cx>]

Robin wrote:

> Looking a bit closer (and in other log files), I see it's people trying random 
> accounts. The big ones are going over a large list, the pairs seem to be just 
> hitting test and guest:
> Jul 26 23:05:59 kallisti sshd[12314]: Illegal user test 
> from ::ffff:64.246.56.44
> Jul 26 23:05:59 kallisti sshd[12314]: Failed password for illegal user test 
> from ::ffff:64.246.56.44 port 41920 ssh2
> Jul 26 23:06:01 kallisti sshd[12320]: Illegal user guest 
> from ::ffff:64.246.56.44
> Jul 26 23:06:01 kallisti sshd[12320]: Failed password for illegal user guest 
> from ::ffff:64.246.56.44 port 41967 ssh2
>
> Does anyone know why this would appear all of a sudden?

I've seen the same on all servers where sshd is running, coming from a 
few IP's. It was also noticed on a Dutch forum, 
http://gathering.tweakers.net/forum/list_messages/937739 is the topic's 
url. I haven't given it much attention, since they were always trying 
only test and guest ... Presumably with the same password.

Tom