Re: intrusion via ssh

[Jacob S <stormspotter@6Texans.net>]

On Thu, 31 Mar 2005 12:55:46 +0200
Frederic Guillet <fguillet@gmail.com> wrote:

> Hi,
> 
> i just checked my mail log on my server (that runs sarge with postfix)
> and got this kind of lines:
> 
> MAR 30 20:01:33 servername sshd[17890] illegal user john from
                                         ^^^^^^^
> 24.15.134.130
> 
> I have about 500 attemps with different usernames and the same IP so i
> guess it is a robot which is trying to enter my system.
> 
> the pb with such log is that it does not say if the user has succeeded
> to enter the machine or if the attempt has failed.
> 
> any config advice or tutorial are welcome.

Actually, it does tell, though perhaps not in the wording you would
like. Linux does not let users do 'illegal' actions. (Talking purely
from a security viewpoint here, not legal. :-)

HTH,
Jacob