Re: crack attempt?

[Philippe Marzouk <phil-antispam@ozigo.org>]

On Tue, Aug 10, 2004 at 02:33:20AM -0500, Will Trillich wrote:
> 
> aha -- i think i actually attracted a script kiddie!
> 
> 
[...]
> 
> ----- End forwarded message -----
> 
> the fact that each attempt is a few seconds from the previous
> one (and that there were only eight tries) leads me to believe
> this was a human, and not a 'bot of some sort.
> 
> he even tried "guest"! (standard windows hole -- is it of likely
> cnocern to a debian system?)
> 

I have exactly the same thing in my logs since a few weeks. In general
from IPs with no reverse DNS set.
They test guest, test sometimes root.
It may be some automated tools as it is always the same logins which are
tried.

I don't worry about it as I do not have this kind of users on my systems
and root is of course not allowed direct ssh login.

Philippe