On Thu, 07 Aug 2003 03:00:12 +0200, Peter Cordes wrote: > sshd logs IP addresses of connections. Was the IP address for those did > not receive id connections inside your site, or does it belong to an ISP > somewhere, or what? If it's a local address, and not a computer lab, that > might give you some clues about whose door to knock on... A professional cracker would have cleaned the sshd logs. So you can't really trust this logfile.