3 ms·
> search your logs of sshd for "Received disconnect from", "Did not receive identification string from" ... This is not reliable advice; many SSH port monitori
by gravitas 6y ago
> search your logs of sshd for "Received disconnect from", "Did not receive identification string from" ...
This is not reliable advice; many SSH port monitoring solutions (including where I work) will do half-connects like this to determine network availability, leaving these log entries by the thousands.
- gnabgib 6y agoHalf connections to determine availability/existence of SSH is exactly what botnets/nefarious actors do. If you know why you have incomplete connections in your logs, then you can filter/ignore them.. those should only be from known IP blocks which you can filter out, but it's unwise to write all off that traffic as "known"
- gravitas 6y agoI agree. My comment was clarifying that your blanket statement implied "if this is seen, it is a problem" and I was providing contradictory evidence that no, it does not always indicate a problem. I personally have been known to telnet to ip:22 while debugging "why doesn't this work"; half-connects are just a part of life, used for both good and evil.