4 ms·
Just had a reminder of that this morning... Was doing a bit of routine maintenance on the server at work when I noticed repeated ssh login attempts appearing in
by jurjenh 14y ago
Just had a reminder of that this morning...
Was doing a bit of routine maintenance on the server at work when I noticed repeated ssh login attempts appearing in the system logs... with usernames that clearly don't exist. Tracing the source ip address sent me to Beijing somewhere, so someone there was trying a port scan and random ssh login attempts.
I've never really looked for this kind of interaction before, and I wonder just how common it is these days - but I'd say that you can now pretty much guarantee that it will happen at some stage, and you'd better hope your security is up to the task.
- nitrogen 14y agoIt even happens if you just open port 22 on your home router. You can use things like fail2ban to put a short-term ban on offending addresses, and put your ssh server on a random (i.e. not 2222) high numbered port to reduce automated scans.
- oofabz 14y agoIt is so common I'd be surprised if you weren't seeing these login attempts. Every ssh server I've run in the last 10 years has had this happen, even those without domain names. They must just scan random IPv4 addresses for anyone responding on port 22. It's the modern equivalent of wardialing.