I just had a browse through my auth.log, and there does seem to be a new sort of automated attack script in the wild - it opens a connection to SSH port 22, (th

I just had a browse through my auth.log, and there does seem to be a new sort of automated attack script in the wild - it opens a connection to SSH port 22, (through some spoofed IP address), but then disconnects before attempting to login. That way, it won't show up as an unsuccessful login attempt for any log-monitoring tools which add its IP address to hosts.deny. However, after it's done that repeatedly (presumably doing some sort of sniffing to work out exactly which version of sshd is running), it then attempts to login. Here's the interesting bit: when it tries to login with a user than doesn't exist, instead of just generating the "Invalid user test from xx.xx.xx.xx" log entry, sshd also outputs another log entry, directly afterwards: "input_userauth_request: invalid user test" which I haven't seen before. I'm not particularly au fait with the internals of sshd, but I would suspect that this new (well, if it is new) script has found an exploit in the part of SSHD which (logically) checks if a user exists first, but the login is being rejected deeper in sshd, when it tries to do the actual authentication. (All the above is speculation, however: I'm no expert on SSH)