Article View: alt.pl.freesco
Article #10838Czy to próby włamania przez SSH?
From: Griszczuk
Date: Tue, 31 May 2005 12:09
Date: Tue, 31 May 2005 12:09
44 lines
2705 bytes
2705 bytes
Witam. Nie dawno uruchomiłem SSH na swoim serwerze Freesco (0.3.0). Przeglądając ostatnie logowania widzę następujące wpisy: May 31 05:45:33 - sshd[62]: input_userauth_request: illegal user test May 31 05:45:33 - sshd[62]: Failed password for illegal user test from 203.151.217.23 port 41381 ssh2 May 31 05:45:34 - sshd[62]: Received disconnect from 203.151.217.23: 11: Bye Bye May 31 05:45:38 - sshd[63]: input_userauth_request: illegal user guest May 31 05:45:38 - sshd[63]: Failed password for illegal user guest from 203.151.217.23 port 41470 ssh2 May 31 05:45:38 - sshd[63]: Received disconnect from 203.151.217.23: 11: Bye Bye May 31 05:45:42 - sshd[68]: input_userauth_request: illegal user admin May 31 05:45:42 - sshd[68]: Failed password for illegal user admin from 203.151.217.23 port 41554 ssh2 May 31 05:45:43 - sshd[68]: Received disconnect from 203.151.217.23: 11: Bye Bye May 31 05:45:48 - sshd[70]: input_userauth_request: illegal user admin May 31 05:45:48 - sshd[70]: Failed password for illegal user admin from 203.151.217.23 port 41632 ssh2 May 31 05:45:49 - sshd[70]: Received disconnect from 203.151.217.23: 11: Bye Bye May 31 05:45:55 - sshd[76]: input_userauth_request: illegal user user May 31 05:45:55 - sshd[76]: Failed password for illegal user user from 203.151.217.23 port 41732 ssh2 May 31 05:45:55 - sshd[76]: Received disconnect from 203.151.217.23: 11: Bye Bye May 31 05:45:59 - sshd[77]: Failed password for root from 203.151.217.23 port 41864 ssh2 May 31 05:46:00 - sshd[77]: Received disconnect from 203.151.217.23: 11: Bye Bye May 31 05:46:10 - sshd[185]: Failed password for root from 203.151.217.23 port 41944 ssh2 May 31 05:46:10 - sshd[185]: Connection closed by 203.151.217.23 Czy to jest efekt skanowania otwartych portów serwera przez inne maszyny? Przepraszam za długi cytat logu. -- Pozdrawiam, Griniu
Technical Details
Message-ID:
<d7hk4u$2qv$1@inews.gazeta.pl>Path:
mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!news.gazeta.pl!not-for-mailShow Full Headers
Complete Article Headers
Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!news.gazeta.pl!not-for-mail From: Griszczuk <przemobi@NIESPAMOWAC.poczta.fm> Newsgroups: alt.pl.freesco Subject: Czy to próby włamania przez SSH? Date: Tue, 31 May 2005 14:09:02 +0200 Organization: "Portal Gazeta.pl -> http://www.gazeta.pl" Lines: 45 Message-ID: <d7hk4u$2qv$1@inews.gazeta.pl> NNTP-Posting-Host: pa200.czarniejewo.sdi.tpnet.pl Mime-Version: 1.0 X-Trace: inews.gazeta.pl 1117541342 2911 217.98.154.200 (31 May 2005 12:09:02 GMT) X-Complaints-To: usenet@agora.pl NNTP-Posting-Date: Tue, 31 May 2005 12:09:02 +0000 (UTC) X-Accept-Language: pl, en-us, en X-User: pmb_dev User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit