🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.pl.freesco
Article #10838

Czy to próby włamania przez SSH?

#10838
From: Griszczuk
Date: Tue, 31 May 2005 12:09
44 lines
2705 bytes
Witam.

Nie dawno uruchomiłem SSH na swoim serwerze Freesco (0.3.0).
Przeglądając ostatnie logowania widzę następujące wpisy:

May 31 05:45:33 - sshd[62]: input_userauth_request: illegal user test
May 31 05:45:33 - sshd[62]: Failed password for illegal user test from 
203.151.217.23 port 41381 ssh2
May 31 05:45:34 - sshd[62]: Received disconnect from 203.151.217.23: 11: 
Bye Bye
May 31 05:45:38 - sshd[63]: input_userauth_request: illegal user guest
May 31 05:45:38 - sshd[63]: Failed password for illegal user guest from 
203.151.217.23 port 41470 ssh2
May 31 05:45:38 - sshd[63]: Received disconnect from 203.151.217.23: 11: 
Bye Bye
May 31 05:45:42 - sshd[68]: input_userauth_request: illegal user admin
May 31 05:45:42 - sshd[68]: Failed password for illegal user admin from 
203.151.217.23 port 41554 ssh2
May 31 05:45:43 - sshd[68]: Received disconnect from 203.151.217.23: 11: 
Bye Bye
May 31 05:45:48 - sshd[70]: input_userauth_request: illegal user admin
May 31 05:45:48 - sshd[70]: Failed password for illegal user admin from 
203.151.217.23 port 41632 ssh2
May 31 05:45:49 - sshd[70]: Received disconnect from 203.151.217.23: 11: 
Bye Bye
May 31 05:45:55 - sshd[76]: input_userauth_request: illegal user user
May 31 05:45:55 - sshd[76]: Failed password for illegal user user from 
203.151.217.23 port 41732 ssh2
May 31 05:45:55 - sshd[76]: Received disconnect from 203.151.217.23: 11: 
Bye Bye
May 31 05:45:59 - sshd[77]: Failed password for root from 203.151.217.23 
port 41864 ssh2
May 31 05:46:00 - sshd[77]: Received disconnect from 203.151.217.23: 11: 
Bye Bye
May 31 05:46:10 - sshd[185]: Failed password for root from 
203.151.217.23 port 41944 ssh2
May 31 05:46:10 - sshd[185]: Connection closed by 203.151.217.23

Czy to jest efekt skanowania otwartych portów serwera przez inne maszyny?
Przepraszam za długi cytat logu.

-- 
Pozdrawiam,
Griniu
Technical Details
Message-ID: <d7hk4u$2qv$1@inews.gazeta.pl>
Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!news.gazeta.pl!not-for-mail

Show Full Headers
Complete Article Headers
Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!news.gazeta.pl!not-for-mail
From: Griszczuk <przemobi@NIESPAMOWAC.poczta.fm>
Newsgroups: alt.pl.freesco
Subject: Czy to próby włamania przez SSH?
Date: Tue, 31 May 2005 14:09:02 +0200
Organization: "Portal Gazeta.pl -> http://www.gazeta.pl"
Lines: 45
Message-ID: <d7hk4u$2qv$1@inews.gazeta.pl>
NNTP-Posting-Host: pa200.czarniejewo.sdi.tpnet.pl
Mime-Version: 1.0
X-Trace: inews.gazeta.pl 1117541342 2911 217.98.154.200 (31 May 2005 12:09:02 GMT)
X-Complaints-To: usenet@agora.pl
NNTP-Posting-Date: Tue, 31 May 2005 12:09:02 +0000 (UTC)
X-Accept-Language: pl, en-us, en
X-User: pmb_dev
User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit