[Dshield] ssh attacks
ryan at csse.uwa.edu.au
Wed Oct 13 00:18:28 GMT 2004
At 08:30 AM 12/10/2004 -0700, you wrote:
>In the last several days I have seen an increase in attempts to log into
>my server via SSH. Previously I was only seeing the "test" and "guest"
>attempts previously mentioned on this list. Here is an example of what I
>Has anyone else been seeing this?
Yeap. All our machines with external ssh access have had it
appear at one time or another. Interestingly it seems to come in
waves. We seem to be in a quiet part of the cycle at the moment, I expect
it to liven up again towards the end of the week. I have noticed that the
list of usernames they're trying to connect with is slowly getting
larger. I've been wondering if thats a progression from finding accounts
on compromised machines.
Ryan McConigley - Systems Administrator _.-,
Computer Science University of Western Australia .--' '-._
Tel: (+61 8) 6488 7082 - Fax: (+61 8) 6488 1089 _/`- _ '.
Ryan[@]csse.uwa.edu.au - http://www.csse.uwa.edu.au/~ryan '----'._`.----. \
"You're just jealous because the voices are talking to me" ;_\
More information about the list