See the thread on inet-access...they are seeing an increase in telnet and ssh probes. School's out and the kiddies are at play. On Sat, 7 Aug 2004 nate at refried.org wrote: > Has anyone else been getting these messages in their logs? It's mostly > attempts to log in as "guest" or "test" through SSH. > > On Tue, Jul 27, 2004 at 04:02:16PM -0000, logcheck at refried.org wrote: > > Security Events > > =-=-=-=-=-=-=-= > > Jul 27 10:26:22 candle sshd[4246]: Failed password for illegal user test from 61.109.156.5 port 3995 ssh2 > > Jul 27 10:26:24 candle sshd[4248]: Failed password for illegal user guest from 61.109.156.5 port 4068 ssh2 > > Jul 27 10:50:50 candle sshd[4343]: Failed password for illegal user test from 61.109.156.5 port 4587 ssh2 > > Jul 27 10:50:52 candle sshd[4345]: Failed password for illegal user guest from 61.109.156.5 port 4666 ssh2 > > Jul 27 10:50:52 candle sshd[4347]: Failed password for illegal user test from 61.109.156.5 port 4687 ssh2 > > Jul 27 10:50:54 candle sshd[4349]: Failed password for illegal user guest from 61.109.156.5 port 4768 ssh2 > On Tue, Aug 03, 2004 at 06:02:15PM -0000, logcheck at refried.org wrote: > > Security Events > > =-=-=-=-=-=-=-= > > Aug 3 12:07:08 candle sshd[7004]: Failed password for illegal user test from 24.100.69.192 port 54042 ssh2 > > Aug 3 12:07:11 candle sshd[7006]: Failed password for illegal user guest from 24.100.69.192 port 54155 ssh2 > > Aug 3 12:07:15 candle sshd[7008]: Illegal user admin from 24.100.69.192 > > Aug 3 12:07:15 candle sshd[7008]: Failed password for illegal user admin from 24.100.69.192 port 54242 ssh2 > > Aug 3 12:07:19 candle sshd[7010]: Illegal user admin from 24.100.69.192 > > Aug 3 12:07:19 candle sshd[7010]: Failed password for illegal user admin from 24.100.69.192 port 54318 ssh2 > > Aug 3 12:07:25 candle sshd[7012]: Failed password for illegal user user from 24.100.69.192 port 54515 ssh2 > > Aug 3 12:07:31 candle sshd[7014]: Failed password for root from 24.100.69.192 port 54641 ssh2 > > Aug 3 12:07:36 candle sshd[7016]: Failed password for root from 24.100.69.192 port 54827 ssh2 > > Aug 3 12:07:42 candle sshd[7018]: Failed password for root from 24.100.69.192 port 54952 ssh2 > > Aug 3 12:07:47 candle sshd[7020]: Failed password for illegal user test from 24.100.69.192 port 55078 ssh2 > > Aug 3 12:10:37 candle sshd[7036]: Failed password for illegal user test from 24.100.69.192 port 59539 ssh2 > > Aug 3 12:10:40 candle sshd[7038]: Failed password for illegal user guest from 24.100.69.192 port 59621 ssh2 > > Aug 3 12:10:43 candle sshd[7040]: Illegal user admin from 24.100.69.192 > > Aug 3 12:10:43 candle sshd[7040]: Failed password for illegal user admin from 24.100.69.192 port 59708 ssh2 > > Aug 3 12:10:50 candle sshd[7042]: Illegal user admin from 24.100.69.192 > > Aug 3 12:10:50 candle sshd[7042]: Failed password for illegal user admin from 24.100.69.192 port 59778 ssh2 > > Aug 3 12:10:58 candle sshd[7044]: Failed password for illegal user user from 24.100.69.192 port 59855 ssh2 > > Aug 3 12:10:59 candle sshd[7046]: Failed password for root from 24.100.69.192 port 59874 ssh2 > > Aug 3 12:11:00 candle sshd[7048]: Failed password for root from 24.100.69.192 port 59892 ssh2 > > Aug 3 12:11:01 candle sshd[7050]: Failed password for root from 24.100.69.192 port 59904 ssh2 > > Aug 3 12:11:02 candle sshd[7052]: Failed password for illegal user test from 24.100.69.192 port 59917 ssh2 > > Aug 3 12:46:50 candle sshd[7187]: Failed password for illegal user test from 80.23.107.114 port 56089 ssh2 > > Aug 3 12:46:52 candle sshd[7189]: Failed password for illegal user guest from 80.23.107.114 port 56149 ssh2 > > Aug 3 12:46:53 candle sshd[7191]: Illegal user admin from 80.23.107.114 > > Aug 3 12:46:53 candle sshd[7191]: Failed password for illegal user admin from 80.23.107.114 port 56212 ssh2 > > Aug 3 12:46:55 candle sshd[7193]: Illegal user admin from 80.23.107.114 > > Aug 3 12:46:55 candle sshd[7193]: Failed password for illegal user admin from 80.23.107.114 port 56272 ssh2 > > Aug 3 12:46:57 candle sshd[7195]: Failed password for illegal user user from 80.23.107.114 port 56337 ssh2 > > Aug 3 12:46:58 candle sshd[7197]: Failed password for root from 80.23.107.114 port 56393 ssh2 > > Aug 3 12:47:00 candle sshd[7199]: Failed password for root from 80.23.107.114 port 56452 ssh2 > > Aug 3 12:47:02 candle sshd[7201]: Failed password for root from 80.23.107.114 port 56496 ssh2 > > Aug 3 12:47:05 candle sshd[7203]: Failed password for illegal user test from 80.23.107.114 port 56536 ssh2 > On Fri, Aug 06, 2004 at 11:02:15PM -0000, logcheck at refried.org wrote: > > Security Events > > =-=-=-=-=-=-=-= > > Aug 6 17:42:34 candle sshd[24161]: Failed password for illegal user test from 132.248.225.118 port 40370 ssh2 > > Aug 6 17:42:35 candle sshd[24163]: Failed password for illegal user guest from 132.248.225.118 port 40404 ssh2 > > Aug 6 17:45:12 candle sshd[24179]: Failed password for illegal user test from 132.248.225.118 port 41995 ssh2 > > Aug 6 17:45:13 candle sshd[24181]: Failed password for illegal user guest from 132.248.225.118 port 42021 ssh2 > On Sat, Aug 07, 2004 at 08:02:16AM -0000, logcheck at refried.org wrote: > > Security Events > > =-=-=-=-=-=-=-= > > Aug 7 02:32:54 candle sshd[29659]: Failed password for illegal user test from 61.19.212.18 port 55079 ssh2 > > > Nate > > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > Help beta test TCLUG's potential new home: http://plone.mn-linux.org > Got pictures for TCLUG? Beta test http://plone.mn-linux.org/gallery > tclug-list at mn-linux.org > https://mailman.real-time.com/mailman/listinfo/tclug-list > _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota Help beta test TCLUG's potential new home: http://plone.mn-linux.org Got pictures for TCLUG? Beta test http://plone.mn-linux.org/gallery tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list