On Wed, Dec 15, 2004 at 11:04:58PM -0700, Mark Gardner wrote: > my messages log has hundreds of theres > Dec 15 09:38:46 McBain sshd(pam_unix)[4483]: authentication failure; > logname= uid=0 euid=0 tty=ssh ruser= > rhost=access-212.14.rev.fr.colt.net > Dec 15 09:38:50 McBain unix_chkpwd[4488]: check pass; user unknown >
My server gets on the average about 500 of these a week for roughly 2-8 clients. I just block them using /etc/hosts.deny (Redhat/Fedora). One thing that helped was turning off root login over ssh. They're likely infected machines just trying to brute force into your machine. Rather annoying really. -- Scott Paul Robertson http://spr.mahonri5.net GnuPG FingerPrint: 09ab 64b5 edc0 903e 93ce edb9 3bcc f8fb dc5d 7601
pgpEnejRp6f56.pgp
Description: PGP signature
-------------------- BYU Unix Users Group http://uug.byu.edu/ The opinions expressed in this message are the responsibility of their author. They are not endorsed by BYU, the BYU CS Department or BYU-UUG. ___________________________________________________________________ List Info: http://uug.byu.edu/cgi-bin/mailman/listinfo/uug-list
