Re: Uptick in SSH scanning?
jp <[email protected]>
| Newsgroups | gmane.org.operators.internet-access |
|---|---|
| Message-ID | <[email protected]> |
We block ssh,telnet,ftp except for IP ranges we or our customers use. hosts.allow/deny is used on the servers, and firewall rules are used on the mikrotiks. At least for the past couple of years, there has been a steady occurence of ssh attempts on devices that allow it. Lots of automated attempts of common sounding usernames and presumably passwords. After seeing so much of it, I'm suprised most other people don't block everything (with allowed exceptions) as a general principal. If I need to access things traveling, I will use a VPN to "phone home", then I will have access via internal IPs. On Wed, Sep 03, 2008 at 09:42:23PM -0500, Chris Adams wrote: > Has anyone else seen a significant rise in SSH scanning in the last day > or two? Rather than my usual short list of blocked hosts (usually under > 10), I've got several hundred blocked right now, and virtually all for > SSH login attempts with invalid users. > > In a handful of tests, I see most running OpenSSH 3.8p1 and 3.8.1p1 > (although I've also seen newer versions, as new as 4.7). A number (but > not all) also seem to be running Debian sarge. Were there some > vulnerabilities in those versions that are being exploited, or are these > just systems with simple usernames and bad passwords? > > -- > Chris Adams <[email protected]> > Systems and Network Administrator - HiWAAY Internet Services > I don't speak for anybody but myself - that's enough trouble. > -- > Eat sushi frequently. - Avi > [email protected] is the human contact address. > [email protected] is the list posting address. > See below URL for subscribe/unsubscribe and list options: > http://inet-access.net/mailman/listinfo/list -- /* Jason Philbrook | Midcoast Internet Solutions - Wireless and DSL KB1IOJ | Broadband Internet Access, Dialup, and Hosting http://f64.nu/ | for Midcoast Maine http://www.midcoast.com/ */ -- Eat sushi frequently. - Avi [email protected] is the human contact address. [email protected] is the list posting address. See below URL for subscribe/unsubscribe and list options: http://inet-access.net/mailman/listinfo/list