Security Incidents mailing list archives

Anyone else seeing SSH scans?


From: Matthew Dharm <mdharm () one-eyed-alien net>
Date: Tue, 27 Jul 2004 10:00:24 -0700

I've noticed that several *NIX machines I have running (all of which are
located in the same IP block) are periodically getting scanned via ssh for
the accounts 'test' and 'guest'.

The source IP varies with each scan.  But I'm getting about one of these a
day now.  Obviously, I don't have accounts with that name on my systems,
but still....

Is this something new, or just people looking for badly configured
machines?

Matt

-- 
Matthew Dharm                              Home: mdharm () one-eyed-alien net 
Senior Software Designer, Momentum Computer

P:  Nine more messages in admin.policy.
M: I know, I'm typing as fast as I can!
                                        -- Pitr and Mike
User Friendly, 11/27/97

Attachment: _bin
Description:


Current thread: