Damien Miller <[EMAIL PROTECTED]> wrote:
> On Fri, 18 Aug 2000, David Lloyd wrote:
>
> > I've just detected a scan to my SMTP port, but I also have this in my
> > logs (kernel and auth):
> >
> > * Aug 18 14:49:14 localhost sshd[22494]: fatal: Did not receive ident
> > string.
>
> This is further evidence of a portscan - someone opened port 22 and
> closed it before sending anything.
Actually, I get the exact same message when connecting to an SSH 1.x
server with an SSH 2.x client. I also get a message immediately
following
saying a valid connection was made. Check your subsequent messages and
their timestamps. That will tell you if it was a probe or a valid
connection.
Michael
