elboricua
El Subestimado
Premium
join:2001-08-12
Bronx, NY | reply to BeesTea
Re: SSH scanning.
Thanks for the heads up. I just checked the logs on my firewall. Lots of "Illegal user test from" entries. More than usual. I normally get one or two a week. I have been getting 3 or 4 a day. Doing a whois on the IP's now. |
|
elboricua
El Subestimado
Premium
join:2001-08-12
Bronx, NY
1 edit | Most of the IP's that have been scanning me are from Quebec and from the UK. In my case the usernames being tried are admin and user. With some root thrown in for good measure.
Some snippits from my logs.
Jul 19 14:42:02 Vulcan-Raven sshd[3959]: Illegal user admin from 213.86.59.248
Jul 19 14:42:02 Vulcan-Raven sshd[20578]: input_userauth_request: illegal user a
dmin
Jul 19 14:42:02 Vulcan-Raven sshd[20578]: Failed password for illegal user admin
from 213.86.59.248 port 40497 ssh2
Jul 19 14:42:02 Vulcan-Raven sshd[20578]: Received disconnect from 213.86.59.248
: 11: Bye Bye
Jul 19 14:42:03 Vulcan-Raven sshd[6934]: Illegal user guest from 213.86.59.248
Jul 19 14:42:03 Vulcan-Raven sshd[30903]: input_userauth_request: illegal user g
uest
Jul 19 14:42:03 Vulcan-Raven sshd[30903]: Failed password for illegal user guest
from 213.86.59.248 port 40525 ssh2
Jul 19 14:42:03 Vulcan-Raven sshd[30903]: Received disconnect from 213.86.59.248
: 11: Bye Bye
Jul 19 14:42:03 Vulcan-Raven sshd[32021]: Illegal user admin from 213.86.59.248
Jul 19 14:42:03 Vulcan-Raven sshd[9129]: input_userauth_request: illegal user ad
min
Jul 19 14:42:03 Vulcan-Raven sshd[9129]: Failed password for illegal user admin
from 213.86.59.248 port 40539 ssh2
Jul 19 14:42:04 Vulcan-Raven sshd[9129]: Received disconnect from 213.86.59.248:
11: Bye Bye
Jul 19 14:42:04 Vulcan-Raven sshd[31823]: Illegal user admin from 213.86.59.248
Jul 19 14:42:04 Vulcan-Raven sshd[24870]: input_userauth_request: illegal user a
dmin
EDIT:
Added loginfo |
|
