Robin wrote:

> Looking a bit closer (and in other log files), I see it's people trying random
> accounts. The big ones are going over a large list, the pairs seem to be just
> hitting test and guest:
> Jul 26 23:05:59 kallisti sshd[12314]: Illegal user test
> from ::ffff:64.246.56.44
> Jul 26 23:05:59 kallisti sshd[12314]: Failed password for illegal user test
> from ::ffff:64.246.56.44 port 41920 ssh2
> Jul 26 23:06:01 kallisti sshd[12320]: Illegal user guest
> from ::ffff:64.246.56.44
> Jul 26 23:06:01 kallisti sshd[12320]: Failed password for illegal user guest
> from ::ffff:64.246.56.44 port 41967 ssh2
>
> Does anyone know why this would appear all of a sudden?

I've seen the same on all servers where sshd is running, coming from a
few IP's. It was also noticed on a Dutch forum,
http://gathering.tweakers.net/forum/list_messages/937739 is the topic's
url. I haven't given it much attention, since they were always trying
only test and guest ... Presumably with the same password.

Tom

[ reply ]