[Techtalk] 216 ssh login attempts, what to do?

[Colleen Hatfield]

On Tue, 12 Oct 2004 18:56:09 -0700, Raquel Rice <raquel at thericehouse.net> wrote:

> I've been seeing attempts to login on multiple ports.  The attempts
> last 5 - 10 minutes on ports as high as 56000.
> 
> --
> Raquel

Hi Raquel,

You're seeing SSH login attempts on ports near 56000?!  If so, are you
running a bunch of sshd's on ports in that range, or are you using
something to sniff the traffic that's telling you it's attempted SSH
logins?  Or is this just random traffic bouncing off your firewall? 
I'm just curious, because I run several on non-standard ports (but
most under 1024), and I haven't seen a single one of these on any of
them the whole time this is going on, though I do see tons of :
sshd[21542]: Failed password for www-data from 211.248.38.252 port 37127 ssh2
on my port 22 servers.

- Colleen