Re: Dictionary attacks on port 22

Harry Putnam wrote:

Thanks for the tips posters. But out of 3 responses none were about
my query. Is there an unusual amount of dictionary attacks on port 22
going on lately?

I think it has increased, but I still don't get anywhere near 13k
in 3 days.

I got 1510 attempts on Feb 25, 1032 attempts yesterday, and 490
attempts so far today (that's for a web server, with an actual
domain name registered, which I assume would increase the likelihood
of attacks, even if only slightly)

Try to see if there are patterns in the IPs -- I mean, if 12.5 of
those 13 come from one IP, then maybe you're being targetted, as
opposed to randomly chosen as a potential victim.

Carlos
--
.

Relevant Pages

  • Re: Dictionary attacks on port 22
    ... I don't see them 'cos the port is closed, ... have an account elsewhere -> cracker needs to crack other account ... traffic on a very thin Internet connection with iptables --recent. ... I'm kind of curious how these dictionary attacks work. ...
    (comp.os.linux.security)
  • Re: How do you handle invalid ssh logins?
    ... tried changing the port that ssh listens on to 10022. ... files to silently lock a userid after 5 invalid passwords on both SSH ... extremely useful technique is to require 'portknocking'. ... I have 11 servers that get hammered with these dictionary attacks. ...
    (linux.redhat)
  • Re: How do you handle invalid ssh logins?
    ... tried changing the port that ssh listens on to 10022. ... files to silently lock a userid after 5 invalid passwords on both SSH ... extremely useful technique is to require 'portknocking'. ... I have 11 servers that get hammered with these dictionary attacks. ...
    (linux.redhat)
  • Re: Annoying login attempts on ssh port
    ... > trying dictionary attacks on my only open port, ... be passive, use a higher port ... if you just do a whois bill, you aren't looking on the net, just ...
    (comp.os.linux.security)
  • Re: sshd known_hosts query
    ... On Sun, 15 Jan 2006, Tony van der Hoff gibbered uncontrollably: ... > I use port 22; ... You allow password-authentication over the open Internet? ... I see dictionary attacks which come to nothing because the idiots are ...
    (uk.comp.os.linux)