[CLUE-Tech] SSH probes

[George Finney]

I've been noticing lots of attempted connections to my ssh enabled boxes.  I was wondering if anyone else has been seeing the same kind of trend.  Typically the messages say "Illegal Protocol version" or just "Disconnected", with the connections lasting for only a second or two.  I've never gotten an attempt from the same address more than once.  I've been running version 3.1 of the ssh.org implementation.

I'm assuming that the illegal protocol version either indicates someone looking for a server running version 1 of ssh, or someone running another implementation of ssh.

The ones that just disconnect are the ones that I'm more concerned with.  Whether they are looking for a windows ssh signature, or a config that allows root login or is looking for a specific vulnerability in ssh...

I suppose with the SSH kiss session last week, I thought it would be good to start a discussion on SSH security.



---------------------------------
Do You Yahoo!?
Yahoo! Tax Center - online filing with TurboTax
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://cluedenver.org/pipermail/clue-tech/attachments/20020416/55f0f0a2/attachment.html