Re: [PLUG] Anyone else seeing a surge of SSH attempts from US IPs?

[Michael Lazin <microlaser@gmail.com>]

The attacks are probably coming from a botnet like this one: https://nakedsecurity.sophos.com/2018/10/24/poorly-secured-ssh-servers-targeted-by-chalubo-botnet/

My guess is they are compromised hosts.

Using ssh key pairs is a great way to prevent being effected by brute force attacks.

On Sun, May 26, 2019 at 1:59 PM Greg Helledy <gregsonh@gra-inc.com> wrote:

In the past, our servers would get maybe one SSH password attempt a
week, usually from China or another far-off corner of the internet.  We
automatically block these after a few tries.

Lately (over the past several weeks), I am seeing more and more
attempts, and they're coming from US IP addresses.  I've shut off SSH
for now but am surprised.  Is anyone else seeing this, or did we get on
a list somewhere?

--
Greg Helledy
GRA, Incorporated
P:  +1 215-884-7500
F:  +1 215-884-1385
www.gra.aero
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

--

Michael Lazin

to gar auto estin noein te kai ennai

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug