On Tue, Apr 12, 2005 at 10:30:23PM +1000, Nick Croft wrote: > * Rob Sharp ([EMAIL PROTECTED]) wrote: > > Funny you should menion it but: > > > > grep Invalid /var/log/auth.log yields > > > > Apr 10 07:05:36 islay sshd[3403]: Invalid user t from ::ffff:211.30.136.xxx > > Apr 10 13:00:41 islay sshd[3823]: Invalid user test from > > ::ffff:61.144.122.39 > > Apr 12 00:05:59 islay sshd[4048]: Invalid user test from > > ::ffff:202.82.195.xxx > > Apr 12 00:06:01 islay sshd[4050]: Invalid user guest from > > ::ffff:202.82.195.xxx > > Apr 12 00:06:04 islay sshd[4052]: Invalid user admin from > > ::ffff:202.82.195.xxx > > Apr 12 00:06:06 islay sshd[4054]: Invalid user admin from > > ::ffff:202.82.195.xxx > > Apr 12 00:06:07 islay sshd[4056]: Invalid user user from > > ::ffff:202.82.195.xxx > > Apr 12 00:06:14 islay sshd[4064]: Invalid user test from > > ::ffff:202.82.195.xxx > > Apr 12 00:06:17 islay sshd[4066]: Invalid user test from > > ::ffff:202.82.195.xxx > > Apr 12 00:06:19 islay sshd[4068]: Invalid user test from > > ::ffff:202.82.195.xxx > > Apr 12 00:06:21 islay sshd[4070]: Invalid user test from > > ::ffff:202.82.195.xxx > > > > All the latter accesses are from the same IP address too... > > > Bah > > test, guest, admin, user > > My would-be sshers are: > > mustang, tigger , maggie , pascal , tara, violet, sheena, nikiata, shadow, > antik, itera, kerlim magnus, lover, krista, liana, gigi, hello, lady, yoko > and zetina. > > They're from Russia, and can keep trying as long as they don't get in.
been seeing this for a while too, I changed sshd to only allow key authentication and I also scan the log and TARPIT the address they are comming from on the hour ! A > > N > -- > SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ > Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html >
signature.asc
Description: Digital signature
-- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
