Way OT: SSH worries

[Alex Neuman]

Good point - I'll try it on an obscure port...

Thanks,

Alex

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Joe Smith
Sent: Monday, August 16, 2004 9:52 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: Way OT: SSH worries

On Mon, 16 Aug 2004, Alex Neuman wrote:

> I'm getting the following in mail logs (through logwatch) and it used to
be
> rare, then a few weeks ago it started happening a few times a week; now it
> happens several times every day: someone's "jiggling the doorknob" on my
> server. Anybody else seen something like this? Is it some kind of rootkit,
> or trojan?
>
> I think I'm going to have to add a rule to drop port 22 packets from
> anywhere but a few locations if this continues.

Try moving your SSHd to a higher port, above 2000 or so.  It slows down
and/or eliminates the script kiddies and the "port knockers".  I've been
doing if for years with no problems.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).