Skip to main content

SSH Security: Why NEVER use SSH without key authentication

Posted in

The following lines were in an access.log after my box was running for five days. I cut it because there were 7782 entries, but you get the idea…..

Nov 5 12:28:59 j5696 sshd[16896]: Invalid user oracle from 66.40.29.100
Nov 5 12:29:00 j5696 sshd[16899]: Invalid user test from 66.40.29.100
Nov 5 15:11:31 j5696 sshd[17052]: Invalid user oracle from 59.60.30.88
Nov 5 15:11:35 j5696 sshd[17055]: Invalid user test from 59.60.30.88

Nov 5 15:11:38 j5696 sshd[17057]: Invalid user guest from 59.60.30.88
Nov 5 15:11:42 j5696 sshd[17059]: Invalid user marta from 59.60.30.88
Nov 5 15:11:45 j5696 sshd[17062]: Invalid user anti from 59.60.30.88
Nov 5 15:11:49 j5696 sshd[17064]: Invalid user dragon from 59.60.30.88
Nov 5 15:11:52 j5696 sshd[17066]: Invalid user test from 59.60.30.88
Nov 5 15:12:03 j5696 sshd[17072]: Invalid user mike from 59.60.30.88
Nov 5 15:12:10 j5696 sshd[17076]: Invalid user mythtv from 59.60.30.88
Nov 5 15:12:39 j5696 sshd[17092]: Invalid user gnax from 59.60.30.88
Nov 5 15:12:49 j5696 sshd[17098]: Invalid user mythtv from 59.60.30.88
Nov 5 15:12:56 j5696 sshd[17102]: Invalid user upload from 59.60.30.88
Nov 5 15:13:00 j5696 sshd[17104]: Invalid user status from 59.60.30.88
Nov 5 15:13:07 j5696 sshd[17108]: Invalid user tomcat from 59.60.30.88
Nov 5 15:13:10 j5696 sshd[17110]: Invalid user postgres from 59.60.30.88
Nov 5 15:13:14 j5696 sshd[17112]: Invalid user anonymous from 59.60.30.88
Nov 5 15:13:17 j5696 sshd[17114]: Invalid user worker from 59.60.30.88
Nov 5 15:13:21 j5696 sshd[17116]: Invalid user craig from 59.60.30.88
Nov 5 15:13:25 j5696 sshd[17118]: Invalid user webmaster from 59.60.30.88
Nov 5 15:13:29 j5696 sshd[17120]: Invalid user user from 59.60.30.88
Nov 5 15:13:39 j5696 sshd[17126]: Invalid user michael from 59.60.30.88
Nov 5 15:13:43 j5696 sshd[17128]: Invalid user short from 59.60.30.88
Nov 5 15:13:46 j5696 sshd[17130]: Invalid user admin from 59.60.30.88
Nov 5 15:13:53 j5696 sshd[17134]: Invalid user music from 59.60.30.88
Nov 5 15:13:58 j5696 sshd[17136]: Invalid user jessie from 59.60.30.88
Nov 5 15:14:01 j5696 sshd[17138]: Invalid user notes from 59.60.30.88
Nov 5 15:14:05 j5696 sshd[17140]: Invalid user turbo from 59.60.30.88
Nov 5 15:14:08 j5696 sshd[17142]: Invalid user usuario from 59.60.30.88
Nov 5 15:14:12 j5696 sshd[17144]: Invalid user spamfiltrer from 59.60.30.88
Nov 5 15:14:15 j5696 sshd[17146]: Invalid user elite from 59.60.30.88
Nov 5 15:14:20 j5696 sshd[17148]: Invalid user ftpuser from 59.60.30.88
Nov 5 15:14:24 j5696 sshd[17150]: Invalid user radmin from 59.60.30.88
Nov 5 15:14:28 j5696 sshd[17152]: Invalid user portal from 59.60.30.88
Nov 5 15:14:31 j5696 sshd[17154]: Invalid user master from 59.60.30.88
Nov 5 15:14:35 j5696 sshd[17156]: Invalid user sales from 59.60.30.88
Nov 5 15:14:38 j5696 sshd[17158]: Invalid user util1 from 59.60.30.88
Nov 5 15:14:42 j5696 sshd[17160]: Invalid user anthony from 59.60.30.88
Nov 5 15:15:02 j5696 sshd[17170]: Invalid user test from 59.60.30.88
Nov 5 15:15:06 j5696 sshd[17172]: Invalid user test from 59.60.30.88
Nov 5 18:13:31 localhost sshd[4734]: Invalid user oracle from 111.10.1.58
Nov 5 18:13:34 localhost sshd[4737]: Invalid user test from 111.10.1.58
Nov 5 18:13:37 localhost sshd[4739]: Invalid user guest from 111.10.1.58
Nov 5 18:13:40 localhost sshd[4741]: Invalid user marta from 111.10.1.58
Nov 5 18:13:42 localhost sshd[4743]: Invalid user anti from 111.10.1.58
Nov 5 18:13:45 localhost sshd[4745]: Invalid user dragon from 111.10.1.58
Nov 5 18:13:48 localhost sshd[4747]: Invalid user test from 111.10.1.58
Nov 5 18:13:57 localhost sshd[4753]: Invalid user mike from 111.10.1.58
Nov 5 18:14:02 localhost sshd[4757]: Invalid user mythtv from 111.10.1.58
Nov 5 18:14:25 localhost sshd[4773]: Invalid user gnax from 111.10.1.58
Nov 5 18:14:34 localhost sshd[4779]: Invalid user mythtv from 111.10.1.58
Nov 5 18:14:39 localhost sshd[4783]: Invalid user upload from 111.10.1.58
Nov 5 18:14:42 localhost sshd[4785]: Invalid user status from 111.10.1.58
Nov 5 18:14:48 localhost sshd[4789]: Invalid user tomcat from 111.10.1.58
Nov 5 18:14:51 localhost sshd[4791]: Invalid user postgres from 111.10.1.58
Nov 5 18:14:53 localhost sshd[4793]: Invalid user anonymous from 111.10.1.58
Nov 5 18:14:56 localhost sshd[4795]: Invalid user worker from 111.10.1.58
Nov 5 18:15:00 localhost sshd[4797]: Invalid user craig from 111.10.1.58
Nov 5 18:15:03 localhost sshd[4799]: Invalid user webmaster from 111.10.1.58
Nov 5 18:15:06 localhost sshd[4801]: Invalid user user from 111.10.1.58
Nov 5 18:15:14 localhost sshd[4807]: Invalid user michael from 111.10.1.58
Nov 5 18:15:17 localhost sshd[4809]: Invalid user short from 111.10.1.58
Nov 5 18:15:20 localhost sshd[4811]: Invalid user admin from 111.10.1.58
Nov 5 18:15:26 localhost sshd[4815]: Invalid user music from 111.10.1.58
Nov 5 18:15:28 localhost sshd[4817]: Invalid user jessie from 111.10.1.58
Nov 5 18:15:31 localhost sshd[4819]: Invalid user notes from 111.10.1.58
Nov 5 18:15:34 localhost sshd[4821]: Invalid user turbo from 111.10.1.58
Nov 5 18:15:37 localhost sshd[4823]: Invalid user usuario from 111.10.1.58
Nov 5 18:15:40 localhost sshd[4825]: Invalid user spamfiltrer from 111.10.1.58
Nov 5 18:15:43 localhost sshd[4827]: Invalid user elite from 111.10.1.58
Nov 5 18:15:45 localhost sshd[4829]: Invalid user ftpuser from 111.10.1.58
Nov 5 18:15:48 localhost sshd[4831]: Invalid user radmin from 111.10.1.58
Nov 5 18:15:51 localhost sshd[4833]: Invalid user portal from 111.10.1.58
Nov 5 18:15:54 localhost sshd[4835]: Invalid user master from 111.10.1.58
Nov 5 18:15:57 localhost sshd[4837]: Invalid user sales from 111.10.1.58
Nov 5 18:16:00 localhost sshd[4839]: Invalid user util1 from 111.10.1.58
Nov 5 18:16:02 localhost sshd[4841]: Invalid user anthony from 111.10.1.58
Nov 5 18:51:08 localhost sshd[4882]: Invalid user oracle from 111.10.1.58
Nov 5 18:51:11 localhost sshd[4885]: Invalid user test from 111.10.1.58
Nov 5 18:51:14 localhost sshd[4887]: Invalid user guest from 111.10.1.58
Nov 5 18:51:16 localhost sshd[4889]: Invalid user marta from 111.10.1.58
Nov 5 18:51:19 localhost sshd[4891]: Invalid user anti from 111.10.1.58
Nov 5 18:51:22 localhost sshd[4893]: Invalid user dragon from 111.10.1.58
Nov 5 18:51:25 localhost sshd[4895]: Invalid user test from 111.10.1.58
Nov 5 18:51:34 localhost sshd[4901]: Invalid user mike from 111.10.1.58
Nov 5 18:51:39 localhost sshd[4905]: Invalid user mythtv from 111.10.1.58
Nov 5 18:52:02 localhost sshd[4921]: Invalid user gnax from 111.10.1.58
Nov 5 18:52:10 localhost sshd[4927]: Invalid user mythtv from 111.10.1.58
Nov 5 18:52:16 localhost sshd[4931]: Invalid user upload from 111.10.1.58
Nov 5 18:52:19 localhost sshd[4933]: Invalid user status from 111.10.1.58
Nov 5 18:52:25 localhost sshd[4937]: Invalid user tomcat from 111.10.1.58
Nov 5 18:52:27 localhost sshd[4939]: Invalid user postgres from 111.10.1.58
Nov 5 18:52:30 localhost sshd[4941]: Invalid user anonymous from 111.10.1.58
Nov 5 18:52:33 localhost sshd[4943]: Invalid user worker from 111.10.1.58
Nov 5 18:52:37 localhost sshd[4945]: Invalid user craig from 111.10.1.58
Nov 5 18:52:40 localhost sshd[4947]: Invalid user webmaster from 111.10.1.58
Nov 5 18:52:42 localhost sshd[4949]: Invalid user user from 111.10.1.58
Nov 5 18:52:51 localhost sshd[4955]: Invalid user michael from 111.10.1.58
Nov 5 18:52:54 localhost sshd[4957]: Invalid user short from 111.10.1.58
Nov 5 18:52:57 localhost sshd[4959]: Invalid user admin from 111.10.1.58
Nov 5 18:53:02 localhost sshd[4963]: Invalid user music from 111.10.1.58
Nov 5 18:53:05 localhost sshd[4965]: Invalid user jessie from 111.10.1.58
Nov 5 18:53:08 localhost sshd[4967]: Invalid user notes from 111.10.1.58
Nov 5 18:53:11 localhost sshd[4969]: Invalid user turbo from 111.10.1.58
Nov 5 18:53:14 localhost sshd[4971]: Invalid user usuario from 111.10.1.58
Nov 5 18:53:17 localhost sshd[4973]: Invalid user spamfiltrer from 111.10.1.58
Nov 5 18:53:20 localhost sshd[4975]: Invalid user elite from 111.10.1.58
Nov 5 18:53:23 localhost sshd[4977]: Invalid user ftpuser from 111.10.1.58
Nov 5 18:53:26 localhost sshd[4979]: Invalid user radmin from 111.10.1.58
Nov 5 18:53:29 localhost sshd[4981]: Invalid user portal from 111.10.1.58
Nov 5 18:53:32 localhost sshd[4983]: Invalid user master from 111.10.1.58
Nov 5 18:53:34 localhost sshd[4985]: Invalid user sales from 111.10.1.58
Nov 5 18:53:37 localhost sshd[4987]: Invalid user util1 from 111.10.1.58
Nov 5 18:53:40 localhost sshd[4989]: Invalid user anthony from 111.10.1.58
Nov 6 02:12:54 localhost sshd[14599]: Invalid user router from 122.166.54.170
Nov 6 02:22:57 localhost sshd[15273]: Invalid user mambo from 122.166.54.170
Nov 6 02:22:59 localhost sshd[15275]: Invalid user rusticos from 122.166.54.170
Nov 6 02:23:00 localhost sshd[15277]: Invalid user rusticos from 122.166.54.170
...
Nov 9 09:18:54 localhost sshd[17413]: Invalid user cd from 222.231.60.234
Nov 9 09:18:57 localhost sshd[17415]: Invalid user office from 222.231.60.234
Nov 9 09:18:59 localhost sshd[17417]: Invalid user ftpuser from 222.231.60.234
Nov 9 09:19:02 localhost sshd[17419]: Invalid user adam from 222.231.60.234
Nov 9 09:19:05 localhost sshd[17421]: Invalid user admin from 222.231.60.234
Nov 9 09:19:08 localhost sshd[17423]: Invalid user sarah from 222.231.60.234
Nov 9 09:19:11 localhost sshd[17425]: Invalid user carol from 222.231.60.234
Nov 9 09:19:13 localhost sshd[17427]: Invalid user boss from 222.231.60.234
Nov 9 09:19:16 localhost sshd[17429]: Invalid user francois from 222.231.60.234
Nov 9 09:19:19 localhost sshd[17431]: Invalid user allan from 222.231.60.234
Nov 9 09:19:22 localhost sshd[17433]: Invalid user bong from 222.231.60.234
Nov 9 09:19:24 localhost sshd[17435]: Invalid user alberto from 222.231.60.234
Nov 9 09:19:27 localhost sshd[17437]: Invalid user sam from 222.231.60.234
Nov 9 09:19:30 localhost sshd[17442]: Invalid user mrtg from 222.231.60.234
Nov 9 09:19:46 localhost sshd[17454]: Invalid user oracle from 222.231.60.234
Nov 9 09:19:49 localhost sshd[17456]: Invalid user www from 222.231.60.234
Nov 9 09:19:51 localhost sshd[17458]: Invalid user webadmin from 222.231.60.234
Nov 9 09:19:54 localhost sshd[17460]: Invalid user jessica from 222.231.60.234
Nov 9 09:20:00 localhost sshd[17464]: Invalid user webmaster from 222.231.60.234
Nov 9 09:20:03 localhost sshd[17466]: Invalid user info from 222.231.60.234
Nov 9 09:20:05 localhost sshd[17468]: Invalid user admin from 222.231.60.234
Nov 9 09:20:08 localhost sshd[17470]: Invalid user eric from 222.231.60.234
Nov 9 09:20:11 localhost sshd[17472]: Invalid user david from 222.231.60.234
Nov 9 12:41:53 localhost sshd[18279]: Invalid user nagios from 69.64.46.35
Nov 9 12:41:54 localhost sshd[18282]: Invalid user oracle from 69.64.46.35
Nov 9 12:41:55 localhost sshd[18284]: Invalid user test from 69.64.46.35
Nov 9 12:41:57 localhost sshd[18286]: Invalid user frank from 69.64.46.35
Nov 9 12:41:58 localhost sshd[18288]: Invalid user dan from 69.64.46.35
Nov 9 12:41:59 localhost sshd[18290]: Invalid user james from 69.64.46.35
Nov 9 12:42:01 localhost sshd[18294]: Invalid user jeff from 69.64.46.35
Nov 9 12:42:02 localhost sshd[18296]: Invalid user amanda from 69.64.46.35
Nov 9 12:42:03 localhost sshd[18298]: Invalid user john from 69.64.46.35
Nov 9 12:42:05 localhost sshd[18302]: Invalid user tony from 69.64.46.35
Nov 9 12:42:08 localhost sshd[18306]: Invalid user apache from 69.64.46.35
Nov 9 12:42:09 localhost sshd[18308]: Invalid user postgres from 69.64.46.35
Nov 9 12:42:10 localhost sshd[18310]: Invalid user paul from 69.64.46.35
Nov 9 12:42:11 localhost sshd[18312]: Invalid user linux from 69.64.46.35
Nov 9 12:42:12 localhost sshd[18314]: Invalid user david from 69.64.46.35
Nov 9 12:42:13 localhost sshd[18316]: Invalid user cyrus from 69.64.46.35
Nov 9 12:42:14 localhost sshd[18318]: Invalid user samba from 69.64.46.35
Nov 9 12:42:15 localhost sshd[18320]: Invalid user www from 69.64.46.35
Nov 9 12:42:16 localhost sshd[18322]: Invalid user guest from 69.64.46.35
Nov 9 12:42:18 localhost sshd[18324]: Invalid user user from 69.64.46.35
Nov 9 12:42:19 localhost sshd[18326]: Invalid user ftp from 69.64.46.35
Nov 9 12:42:20 localhost sshd[18328]: Invalid user voip from 69.64.46.35
Nov 9 12:42:21 localhost sshd[18330]: Invalid user voip from 69.64.46.35
Nov 9 12:42:22 localhost sshd[18332]: Invalid user sip from 69.64.46.35
Nov 9 12:42:23 localhost sshd[18334]: Invalid user httpd from 69.64.46.35
Nov 9 12:42:24 localhost sshd[18336]: Invalid user http from 69.64.46.35
Nov 9 12:42:25 localhost sshd[18338]: Invalid user http from 69.64.46.35
Nov 9 12:42:26 localhost sshd[18340]: Invalid user httpd from 69.64.46.35
Nov 9 12:42:46 localhost sshd[18376]: Invalid user janos from 69.64.46.35
Nov 9 12:42:51 localhost sshd[18384]: Invalid user bvgroup from 69.64.46.35
Nov 9 12:42:56 localhost sshd[18394]: Invalid user wiki from 69.64.46.35
Nov 9 12:42:57 localhost sshd[18396]: Invalid user oracle from 69.64.46.35
Nov 9 12:42:59 localhost sshd[18398]: Invalid user guest from 69.64.46.35
Nov 9 12:43:00 localhost sshd[18400]: Invalid user nagios from 69.64.46.35
Nov 9 12:43:02 localhost sshd[18404]: Invalid user stein from 69.64.46.35
Nov 9 12:43:03 localhost sshd[18406]: Invalid user oracle from 69.64.46.35
Nov 9 12:43:06 localhost sshd[18412]: Invalid user j.mori from 69.64.46.35
Nov 9 12:43:25 localhost sshd[18446]: Invalid user fish from 69.64.46.35
Nov 9 12:43:27 localhost sshd[18450]: Invalid user super from 69.64.46.35
Nov 9 12:43:29 localhost sshd[18454]: Invalid user sir from 69.64.46.35
Nov 9 12:43:35 localhost sshd[18464]: Invalid user xvf from 69.64.46.35
Nov 9 12:43:38 localhost sshd[18470]: Invalid user nasa from 69.64.46.35
Nov 9 12:43:44 localhost sshd[18480]: Invalid user itsadmin from 69.64.46.35
Nov 9 12:44:04 localhost sshd[18516]: Invalid user oracle from 69.64.46.35
Nov 9 12:44:05 localhost sshd[18518]: Invalid user test from 69.64.46.35
Nov 9 12:44:38 localhost sshd[18581]: Invalid user john from 69.64.46.35
Nov 9 12:44:39 localhost sshd[18583]: Invalid user oracle from 69.64.46.35
Nov 9 12:44:40 localhost sshd[18585]: Invalid user admin from 69.64.46.35
Nov 9 12:44:41 localhost sshd[18587]: Invalid user nagios from 69.64.46.35
Nov 9 12:44:42 localhost sshd[18589]: Invalid user ana from 69.64.46.35
Nov 9 12:44:44 localhost sshd[18591]: Invalid user pula from 69.64.46.35
Nov 9 12:44:45 localhost sshd[18593]: Invalid user sugi from 69.64.46.35
Nov 9 12:44:46 localhost sshd[18595]: Invalid user gsm from 69.64.46.35
Nov 9 12:44:47 localhost sshd[18597]: Invalid user success from 69.64.46.35