[ale] SSH attempts

[david at systemoverlord.com (David Tomaschik)]

You could drop traffic from that host/subnet/etc, at the risk of
blocking legitimate traffic.

Most likely, those hosts are compromised hosts, unless ServerLoft is a
bit of a black hat haven.  They'll probably notify the VPS owners
and/or take them down.

David


On Mon, Sep 12, 2011 at 11:05 AM, David Hillman <hillmands at gmail.com> wrote:
> According to the PortSentry logs for my server, I have received thousands of
> connection attempts via SSH port 22. ?Of course, that is not the port the
> real SSH service is listening on. Logins were also disabled for root.
> What's interesting is the IP addresses all belong to Serverloft
> (www.serverloft.eu); most attempts came from 188.138.32.16
> (loft4385.serverloft.eu). ?I am guessing someone with a few VPS boxes has
> nothing better to do than use up network bandwidth to terrorize the rest of
> us. ?Or, maybe those boxes have been compromised.
> I have e-mailed the folks over over at Serverloft, but I don't expect
> anything of it. ?Is there anything else I can do?



-- 
David Tomaschik, RHCE, LPIC-1
System Administrator/Open Source Advocate
OpenPGP: 0x5DEA789B
http://systemoverlord.com
david at systemoverlord.com