dave Apr 8, 2009 #1 I have a unusually heavy load of SSH attacks on my servers this morning. Is anyone else experiencing this? Could this be Conficker?
I have a unusually heavy load of SSH attacks on my servers this morning. Is anyone else experiencing this? Could this be Conficker?
DutchDaemon Administrator Staff member Administrator Moderator Developer Apr 8, 2009 #2 http://isc.sans.org/diary.html?storyid=6148
V Vib3 Apr 28, 2009 #3 dave said: I have a unusually heavy load of SSH attacks on my servers this morning. Is anyone else experiencing this? Could this be Conficker? Click to expand... Not conficker, but some other malware. I have got many attacks too. Check your sshd_config and install sshguard. I am happy with using it
dave said: I have a unusually heavy load of SSH attacks on my servers this morning. Is anyone else experiencing this? Could this be Conficker? Click to expand... Not conficker, but some other malware. I have got many attacks too. Check your sshd_config and install sshguard. I am happy with using it
SirDice Administrator Staff member Administrator Moderator Apr 28, 2009 #4 AFAIK Conficker doesn't use ssh to spread itself. The baddies just found your box.. Welcome to the internet
AFAIK Conficker doesn't use ssh to spread itself. The baddies just found your box.. Welcome to the internet
gilinko Apr 28, 2009 #6 You could also try the built in firewall pf with sshguard. Easy as pie to setup...
