Distributed SSH Attack?

[dave]

I have a unusually heavy load of SSH attacks on my servers this morning. Is anyone else experiencing this? Could this be Conficker?

 

[DutchDaemon]

http://isc.sans.org/diary.html?storyid=6148

 

[Vib3]

I have a unusually heavy load of SSH attacks on my servers this morning. Is anyone else experiencing this? Could this be Conficker?

Not conficker, but some other malware. I have got many attacks too.

Check your sshd_config and install sshguard.

I am happy with using it

 

[SirDice]

AFAIK Conficker doesn't use ssh to spread itself.

The baddies just found your box.. Welcome to the internet

 

[dave]

I use security/denyhosts.

 

[gilinko]

You could also try the built in firewall pf with sshguard. Easy as pie to setup...