SecurityFocus

Weird SSH attack last night and this morning (still ongoing) May 07 2008 12:27PM
Gary Baribault (gary baribault net) (6 replies)

Re: Weird SSH attack last night and this morning (still ongoing) May 14 2008 08:25AM
Mick Pollard (lists lunix com au) (1 replies)

Re: Weird SSH attack last night and this morning (still ongoing) May 14 2008 11:05PM
Gary Baribault (gary baribault net) (1 replies)

Re: Weird SSH attack last night and this morning (still ongoing) May 15 2008 09:41PM
Valdis Kletnieks vt edu

Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:01PM
Brent Kearney (brentk birs ca)

Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:01PM
bugtraq bunten de

RE: Weird SSH attack last night and this morning (still ongoing) May 07 2008 05:53PM
Erin Carroll (amoeba amoebazone com) (1 replies)

Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:17PM
Valdis Kletnieks vt edu

Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 05:36PM
Blaine Fleming (groups digital-z com)

Gary Baribault wrote:
> I don't know what is going on last night and this morning ... I have
> three Linux servers facing the Internet, two on cable modems and
> another on a static IP/commercial connection and this last one is a
> gateway to a Web/FTP/SMTP/Pop3/NTP Linux based system.
> <snip>
> Is any one else seing this? or am I being targeted? This is still
> going on now .. and it started arround 10:00 last night GMT+4

I've had one system bouncing off of SSH on one of my servers for about a
week now. I have fail2ban configured to drop them for six hours after
five failed connects. The server in question is configured for key
authentication only but they keep trying to submit a password anyway.
The second the ban drops I see them connecting again. Other than that,
I haven't seen anything bouncing off my servers repeatedly. Everything
gets banned once and never comes back.

--Blaine

[ reply ]

Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 05:04PM
Robert Taylor (rjamestaylor gmail com) (1 replies)

RE: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:15PM
Erin Carroll (amoeba amoebazone com) (1 replies)

Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:23PM
Robert Taylor (rjamestaylor gmail com) (1 replies)

RE: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:27PM
Erin Carroll (amoeba amoebazone com)