[geeks] ssh attacks

[Gary Nichols]

On Wed, 11 Aug 2004, Kevin wrote:

> Lately, i've been getting several ssh login attempts to accounts
> user, admin and test.  Mostly from European and Asian countries.
> 
> Is there some type of automated worm out there trying to exploit
> an ssh vulnerability?
> 
> Anyone else getting this crap?

I've been tracking this thing for weeks.  It's an automated probe tool 
using known accounts.  I have some leads on the motive, but nothing 
concrete enough that I'm going to mention here.

I *really* recommend that you move ssh to another port.  You'll take 
yourself off the radar for 99% of the tools out there, unless they REALLY 
want YOUR box.