Gé Weijers wrote:
On Mon, Aug 13, 2012 at 9:01 AM, Leonard den Ottolander leonard@den.ottolander.nl wrote:
Hello Mark,
On Mon, 2012-08-13 at 11:30 -0400, m.roth@5-cent.us wrote:
Aug 10 17:44:56 <my server> sshd[12350]: Connection from 114.113.199.142 port 511 871 Aug 10 17:44:57 <my server> sshd[12341]: Received disconnect from 114.113.199.144 2: 11: Bye Bye
The above looks like someone connecting then disconnecting without even attempting a login.
Some attack programs are too stupid to give up even if they find that password and keyboard interactive authentication is turned off. One kept trying for weeks.
Then there are the ones who don't realize that, but are the low-flyers, that spend weeks trying to break in, but at the same time hit slowly, so that they won't be noticed by programs like fail2ban.
mark