I guess what I reported last week was the warmup round .. Where now
getting thousands of attemped logins with the standars dictionary of
potential login names.
As I stated, I'm not interested in avoiding these attacks, so please
don't sugges that I change the SSH port, my machines are safe enough ..
For those who missed it, I have three servers on the Internet, two cable
modems and one static and again, two of them are getting about 100
attacks per hour but instead of using Root for every attempt, we are now
seeing the standars alphabetical list of users.
What wories me is all of the Linux/Unix servers out there (and I guess
to a lesser degree Windows boxes with an SSH Daemon) that have many
normal remote users who are allowed remote access with SSH and have weak
passwords.
This attack seems to be aimed at them, and will certainly succeed.
See a sample of one of my logs below
Gary B
messages:May 11 21:59:39 salle sshd[5493]: Invalid user a'marie from
213.251.185.54
messages:May 11 21:59:39 salle sshd[5493]: Failed
keyboard-interactive/pam for invalid user a'marie from 213.251.185.54
port 33943 ssh2
messages:May 11 22:01:34 salle sshd[5519]: Invalid user aaliyah from
62.206.228.188
messages:May 11 22:01:34 salle sshd[5519]: Failed
keyboard-interactive/pam for invalid user aaliyah from 62.206.228.188
port 49207 ssh2
messages:May 11 22:03:11 salle sshd[5524]: Invalid user aaralyn from
212.220.166.26
messages:May 11 22:03:11 salle sshd[5524]: Failed
keyboard-interactive/pam for invalid user aaralyn from 212.220.166.26
port 1408 ssh2
messages:May 11 22:04:05 salle sshd[5528]: Invalid user aaron from
83.151.29.86
messages:May 11 22:04:05 salle sshd[5528]: Failed
keyboard-interactive/pam for invalid user aaron from 83.151.29.86 port
55756 ssh2
messages:May 11 22:05:34 salle sshd[5533]: Invalid user abbie from
70.43.165.34
messages:May 11 22:05:34 salle sshd[5533]: Failed
keyboard-interactive/pam for invalid user abbie from 70.43.165.34 port
48681 ssh2
messages:May 11 22:06:41 salle sshd[5537]: Invalid user abbott from
194.204.62.2
messages:May 11 22:06:41 salle sshd[5537]: Failed
keyboard-interactive/pam for invalid user abbott from 194.204.62.2 port
7799 ssh2
messages:May 11 22:08:33 salle sshd[5543]: Invalid user abdukrahman from
62.206.22.124
messages:May 11 22:08:34 salle sshd[5543]: Failed
keyboard-interactive/pam for invalid user abdukrahman from 62.206.22.124
port 50525 ssh2
messages:May 11 22:12:11 salle sshd[5558]: Invalid user abdulrahman from
196.211.191.58
messages:May 11 22:12:12 salle sshd[5558]: Failed
keyboard-interactive/pam for invalid user abdulrahman from
196.211.191.58 port 58081 ssh2
messages:May 11 22:12:55 salle sshd[5562]: Invalid user abe from
217.172.164.130
messages:May 11 22:12:55 salle sshd[5562]: Failed
keyboard-interactive/pam for invalid user abe from 217.172.164.130 port
56462 ssh2
messages:May 11 22:13:53 salle sshd[5566]: Invalid user abel from
80.68.94.169
messages:May 11 22:13:54 salle sshd[5566]: Failed
keyboard-interactive/pam for invalid user abel from 80.68.94.169 port
2229 ssh2
messages:May 11 22:15:47 salle sshd[5592]: Invalid user abia from
86.49.7.207
messages:May 11 22:15:47 salle sshd[5592]: Failed
keyboard-interactive/pam for invalid user abia from 86.49.7.207 port
1407 ssh2
messages:May 11 22:16:32 salle sshd[5595]: Invalid user abiba from
200.117.122.206
messages:May 11 22:16:33 salle sshd[5595]: Failed
keyboard-interactive/pam for invalid user abiba from 200.117.122.206
port 53258 ssh2
messages:May 11 22:18:02 salle sshd[5599]: Invalid user abie from
208.189.14.194
messages:May 11 22:18:02 salle sshd[5599]: Failed
keyboard-interactive/pam for invalid user abie from 208.189.14.194 port
36420 ssh2
messages:May 11 22:18:24 salle sshd[5602]: Invalid user abigail from
69.128.70.86
messages:May 11 22:18:25 salle sshd[5602]: Failed
keyboard-interactive/pam for invalid user abigail from 69.128.70.86 port
3154 ssh2
messages:May 11 22:19:53 salle sshd[5605]: Invalid user abner from
62.147.203.49
messages:May 11 22:19:53 salle sshd[5605]: Failed
keyboard-interactive/pam for invalid user abner from 62.147.203.49 port
38321 ssh2
messages:May 11 22:20:17 salle sshd[5608]: Invalid user abra from
61.29.122.140
messages:May 11 22:20:17 salle sshd[5609]: input_userauth_request:
invalid user abra
messages:May 11 22:20:17 salle sshd[5608]: Failed
keyboard-interactive/pam for invalid user abra from 61.29.122.140 port
53367 ssh2
messages:May 11 22:20:57 salle sshd[5612]: Invalid user abra from
200.166.58.108
messages:May 11 22:20:58 salle sshd[5612]: Failed
keyboard-interactive/pam for invalid user abra from 200.166.58.108 port
41499 ssh2
messages:May 11 22:21:28 salle sshd[5615]: Invalid user abraham from
82.193.22.18
messages:May 11 22:21:28 salle sshd[5616]: input_userauth_request:
invalid user abraham
messages:May 11 22:21:28 salle sshd[5615]: Failed
keyboard-interactive/pam for invalid user abraham from 82.193.22.18 port
33116 ssh2
messages:May 11 22:22:36 salle sshd[5619]: Invalid user abram from
66.159.198.155
messages:May 11 22:22:37 salle sshd[5619]: Failed
keyboard-interactive/pam for invalid user abram from 66.159.198.155 port
45869 ssh2
messages:May 11 22:22:53 salle sshd[5622]: Invalid user abram from
89.110.144.212
messages:May 11 22:22:53 salle sshd[5623]: input_userauth_request:
invalid user abram
messages:May 11 22:22:53 salle sshd[5622]: Failed
keyboard-interactive/pam for invalid user abram from 89.110.144.212 port
35527 ssh2
messages:May 11 22:23:29 salle sshd[5625]: Invalid user abrianna from
204.13.164.75
messages:May 11 22:23:29 salle sshd[5625]: Failed
keyboard-interactive/pam for invalid user abrianna from 204.13.164.75
port 36896 ssh2
messages:May 11 22:24:22 salle sshd[5629]: Invalid user abrienda from
87.234.200.80
messages:May 11 22:24:22 salle sshd[5629]: Failed
keyboard-interactive/pam for invalid user abrienda from 87.234.200.80
port 17603 ssh2
messages:May 11 22:25:04 salle sshd[5632]: Invalid user abrienda from
168.234.199.84
messages:May 11 22:25:04 salle sshd[5632]: Failed
keyboard-interactive/pam for invalid user abrienda from 168.234.199.84
port 47504 ssh2
messages:May 11 22:25:52 salle sshd[5635]: Invalid user abril from
83.246.96.70
messages:May 11 22:25:52 salle sshd[5635]: Failed
keyboard-interactive/pam for invalid user abril from 83.246.96.70 port
48594 ssh2
messages:May 11 22:25:55 salle sshd[5638]: Invalid user abril from
62.2.99.174
messages:May 11 22:25:56 salle sshd[5638]: Failed
keyboard-interactive/pam for invalid user abril from 62.2.99.174 port
1424 ssh2
messages:May 11 22:27:00 salle sshd[5642]: Invalid user absolom from
200.117.122.206
messages:May 11 22:27:01 salle sshd[5642]: Failed
keyboard-interactive/pam for invalid user absolom from 200.117.122.206
port 45918 ssh2
messages:May 11 22:27:15 salle sshd[5645]: Invalid user abu from
85.14.219.67
messages:May 11 22:27:15 salle sshd[5645]: Failed
keyboard-interactive/pam for invalid user abu from 85.14.219.67 port
38085 ssh2
messages:May 11 22:28:48 salle sshd[5649]: Invalid user acacia from
64.83.58.161
messages:May 11 22:28:48 salle sshd[5649]: Failed
keyboard-interactive/pam for invalid user acacia from 64.83.58.161 port
39750 ssh2
messages:May 11 22:30:48 salle sshd[5675]: Invalid user ace from
61.29.122.140
messages:May 11 22:30:48 salle sshd[5676]: input_userauth_request:
invalid user ace
messages:May 11 22:30:48 salle sshd[5675]: Failed
keyboard-interactive/pam for invalid user ace from 61.29.122.140 port
60660 ssh2
messages:May 11 22:32:25 salle sshd[5680]: Invalid user acton from
217.98.80.5
messages:May 11 22:32:25 salle sshd[5680]: Failed
keyboard-interactive/pam for invalid user acton from 217.98.80.5 port
10497 ssh2
messages:May 11 22:32:57 salle sshd[5683]: Invalid user acton from
88.198.47.143
messages:May 11 22:32:57 salle sshd[5683]: Failed
keyboard-interactive/pam for invalid user acton from 88.198.47.143 port
39369 ssh2
messages:May 11 22:33:21 salle sshd[5686]: Invalid user ada from
200.74.136.246
messages:May 11 22:33:21 salle sshd[5686]: Failed
keyboard-interactive/pam for invalid user ada from 200.74.136.246 port
35651 ssh2
messages:May 11 22:33:51 salle sshd[5689]: Invalid user ada from
69.15.102.215
messages:May 11 22:33:51 salle sshd[5689]: Failed
keyboard-interactive/pam for invalid user ada from 69.15.102.215 port
50657 ssh2
messages:May 11 22:34:57 salle sshd[5693]: Invalid user adah from
216.197.204.76
messages:May 11 22:34:57 salle sshd[5693]: Failed
keyboard-interactive/pam for invalid user adah from 216.197.204.76 port
43581 ssh2
messages:May 11 22:35:17 salle sshd[5696]: Invalid user adair from
76.160.167.251
messages:May 11 22:35:17 salle sshd[5696]: Failed
keyboard-interactive/pam for invalid user adair from 76.160.167.251 port
50495 ssh2
messages:May 11 22:38:36 salle sshd[5715]: Invalid user adamina from
201.21.210.151
messages:May 11 22:38:36 salle sshd[5716]: input_userauth_request:
invalid user adamina
messages:May 11 22:38:37 salle sshd[5715]: Failed
keyboard-interactive/pam for invalid user adamina from 201.21.210.151
port 34881 ssh2
messages:May 11 22:38:54 salle sshd[5718]: Invalid user adamina from
133.6.61.76
messages:May 11 22:38:54 salle sshd[5718]: Failed
keyboard-interactive/pam for invalid user adamina from 133.6.61.76 port
44428 ssh2
messages:May 11 22:39:29 salle sshd[5721]: Invalid user adamma from
212.51.52.244
messages:May 11 22:39:29 salle sshd[5721]: Failed
keyboard-interactive/pam for invalid user adamma from 212.51.52.244 port
41180 ssh2
messages:May 11 22:39:51 salle sshd[5724]: Invalid user adamma from
83.244.156.204
messages:May 11 22:39:51 salle sshd[5724]: Failed
keyboard-interactive/pam for invalid user adamma from 83.244.156.204
port 50954 ssh2
messages:May 11 22:41:02 salle sshd[5735]: Invalid user adara from
88.198.47.143
messages:May 11 22:41:02 salle sshd[5735]: Failed
keyboard-interactive/pam for invalid user adara from 88.198.47.143 port
33031 ssh2
messages:May 11 22:42:28 salle sshd[5738]: Invalid user addison from
62.2.211.46
messages:May 11 22:42:28 salle sshd[5738]: Failed
keyboard-interactive/pam for invalid user addison from 62.2.211.46 port
29580 ssh2
