Way OT: SSH worries

[Joe Smith]

On Mon, 16 Aug 2004, Alex Neuman wrote:

> I'm getting the following in mail logs (through logwatch) and it used to be
> rare, then a few weeks ago it started happening a few times a week; now it
> happens several times every day: someone's "jiggling the doorknob" on my
> server. Anybody else seen something like this? Is it some kind of rootkit,
> or trojan?
>
> I think I'm going to have to add a rule to drop port 22 packets from
> anywhere but a few locations if this continues.

Try moving your SSHd to a higher port, above 2000 or so.  It slows down
and/or eliminates the script kiddies and the "port knockers".  I've been
doing if for years with no problems.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).