ssh 'attack'

[Net Llama!]

On Fri, 27 Aug 2004, Ken Moffat wrote:
> Roger Oberholtzer wrote:
>
> >On Fri, 2004-08-27 at 19:02, Net Llama! wrote:
> >
> >
> >
> >>>This has been going on for years.  We reject thousands of these every month
> >>>using tcp_wrappers.
> >>>
> >>>
> >>Perhaps on your neck of the internet, but not everywhere.  I think its
> >>gotten significantly worse in the past few months.  I used to see maybe
> >>one attempt/box a month.  Now its 8-12/box per day.
> >>
> >>
> >
> >Same here. I think the .se domain (where my system is) is just getting
> >this recently.
> >
> >
> >
>
> Odd, I check messages often and have not seen this. Perhaps my firewall
> is working. I have dsl running through a Linksys, but I do have several
> ports open.

They are all ssh login attemtps.  So unless you have sshd exposed to the
internet, you're not going to see it.  And odds are they're not bothering
with random DSL connections.

The boxes where i'm seeing this are at my place of employment, not at
home.

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Lonni J Friedman                                netllama at linux-sxs.org
Linux Step-by-step & TyGeMo                  http://netllama.ipfox.com