Re: [MLUG] SSH attempts from admin, guest, test, user

[Michael <EMAIL:PROTECTED>]

I've been getting that stuff for months. On both SSH and FTP. It 
definately comes from a wide range of IP's so it's some sort of 
distributed attack. Pretty harmless though as I don't have any weak 
passwords, don't run any out-dated software, and the only FTP I run is SFTP.

> Prob not a worm - but looks like someone scanning for open/common 
> accounts.
>  
> I run all my ssh sessions on a high port. Being that you're not behind 
> a FW (Univ doesn't use one last I knew) this shouldn't be a problem. 
> This keeps the noise away.
>
>     ------------------------------------------------------------------------
>     **
>     Hey, thought I'd ask the LUG as no one else seems to have a clue
>     in hell what this is. I've been for several weeks/months getting
>     repeated attempts on an ssh port on our linux boxen here at work. :
>
>     admin/password from 66.28.207.16: 2 Time(s)
>     guest/password from 203.251.69.201: 2 Time(s)
>     guest/password from 65.120.161.253: 1 Time(s)
>     guest/password from 66.28.207.16: 1 Time(s)
>     root/password from 66.28.207.16: 3 Time(s)
>     test/password from 140.122.85.152: 1 Time(s)
>     test/password from 203.251.69.201: 2 Time(s)
>     test/password from 65.120.161.253: 1 Time(s)
>     test/password from 66.28.207.16: 2 Time(s)
>     user/password from 66.28.207.16: 1 Time(s)
>
>     Authentication Failures:
>     root (server106.extremerack.com ): 3 Time(s)
>     unknown (ns2.itbank.net ): 4 Time(s)
>     unknown (black.bibliodirect.com ): 2 Time(s)
>     unknown (140.122.85.152 ): 1 Time(s)
>     unknown (server106.extremerack.com ): 6 Time(s)
>
>     Anyone heard of something like this, or have half a clue what the
>     heck is going on? I've been monitoring these attempts for weeks
>     (maybe months - can't remember the first time I saw it). It looks
>     like a worm from the way it's acting, but it's weird. Thoughts anyone?
>


-- 
Michael <EMAIL:PROTECTED>
http://kavlon.org

_______________________________________________
members mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/members