[WBEL-users] Daily SSH attempted logins

[Cameron Showalter]

Scott Silva wrote:

>Tony wrote:
>  
>
>>whitebox-users-request at beau.org wrote:
>>
>>    
>>
>>>Send Whitebox-users mailing list submissions to
>>>    whitebox-users at beau.org
>>>
>>>To subscribe or unsubscribe via the World Wide Web, visit
>>>    http://beau.org/mailman/listinfo/whitebox-users
>>>or, via email, send a message with subject or body 'help' to
>>>    whitebox-users-request at beau.org
>>>
>>>You can reach the person managing the list at
>>>    whitebox-users-owner at beau.org
>>>
>>>When replying, please edit your Subject line so it is more specific
>>>than "Re: Contents of Whitebox-users digest..."
>>>
>>>
>>>Today's Topics:
>>>
>>>  1. Re: Daily SSH attempted logins (Scott Silva)
>>>
>>>
>>>----------------------------------------------------------------------
>>>
>>>Message: 1
>>>Date: Mon, 07 Mar 2005 09:36:44 -0800
>>>From: Scott Silva <ssilva at sgvwater.com>
>>>Subject: Re: [WBEL-users] Daily SSH attempted logins
>>>To: whitebox-users at beau.org
>>>Message-ID: <d0i34q$lb7$1 at sea.gmane.org>
>>>Content-Type: text/plain; charset=ISO-8859-1
>>>
>>>John Hinton wrote:
>>> 
>>>
>>>      
>>>
>>>>Anybody got a good way to stop these SSH login attempts going around?
>>>>Besides killing sshd?
>>>>
>>>>Best,
>>>>John Hinton
>>>>  
>>>>        
>>>>
>>>Move sshd to a different port.
>>>
>>>
>>> 
>>>
>>>      
>>>
>>I tried that myself..  Only worked for a couple of days.. Then they
>>switched to the new port..  I get
>>several attemtped per second.. its almost a DoS ..
>>
>>Killing SSHD isnt an option for me. i would like to get back in from the
>>outside.
>>
>>And it pisses me off too ..  world has gone to pot..
>>    
>>
>It has worked for me for over a year now!
>Someone must be targeting you!
>Have you tried a much higher port? Most of the scan attempts I see don't
>seem to try above 1024 or so.
>
>
>  
>

Concur.  I've set up ssh port on 9 separate firewalls, much higher than 
1024.  up high where no one usually looks...  just remember where you 
put it, and standardize between sites if you are running multiple 
locations.