RE: ssh scans with user test, guest , admin
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <000001c48e15$368882f0$0201a8c0@netsec> |
I have also seen ssh entries in log files coming from different IPs on multiple clients. Is an ongoing issue of brute force attacks that have been happening for the past couple of months. Read http://isc.sans.org/diary.php?date=2004-07-28 http://isc.sans.org/diary.php?date=2004-08-22 Date: Sat, 28 Aug 2004 19:36:10 +0200 From: "cristi stoia" <[email protected]> Subject: [Intrusions] ssh scans with user test, guest , admin To: [email protected] Message-ID: <[email protected]> Content-Type: text/plain; charset="iso-8859-1" hi everyone, i'm running 5 servers (mail + masq) and starting from last month on every server i can see ssh scans with user test, guest, admin, and root from diferent ip-s more than once per day.it looks like a centralized, automated scan because the time between password tries and user change is very short, and the scans came at same interval of the day. enyone seeing this in the logs ? _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions