[Techtalk] 216 ssh login attempts, what to do?

[Raquel Rice]

On Tue, 12 Oct 2004 21:10:36 -0500
Colleen Hatfield <evilpig at gmail.com> wrote:

> On Tue, 12 Oct 2004 18:56:09 -0700, Raquel Rice
> <raquel at thericehouse.net> wrote:
> 
> > I've been seeing attempts to login on multiple ports.  The
> > attempts last 5 - 10 minutes on ports as high as 56000.
> > 
> > --
> > Raquel
> 
> Hi Raquel,
> 
> You're seeing SSH login attempts on ports near 56000?!  If so, are
> you running a bunch of sshd's on ports in that range, or are you
> using something to sniff the traffic that's telling you it's
> attempted SSH logins?  Or is this just random traffic bouncing off
> your firewall? I'm just curious, because I run several on
> non-standard ports (but most under 1024), and I haven't seen a
> single one of these on any of them the whole time this is going
> on, though I do see tons of : sshd[21542]: Failed password for
> www-data from 211.248.38.252 port 37127 ssh2 on my port 22
> servers.
> 
> - Colleen

My SSH runs on port 22 also.  The attempts are found in auth.log.  I
assume "whoever" is trying to find something open?  Some weakness?

-- 
Raquel
============================================================
Don't be afraid to give your best to what seemingly are small jobs.
Every time you conquer one it makes you that much stronger. If you
do the little jobs well, the big ones tend to take care of
themselves.
  --Dale Carnegie