Amusement: after I set sshd to disallow password authentication, I got this:
Dec 3 09:50:07 bunsen-honeydew sshd[54753]: Invalid user admin from 219.237.242.171
Dec 3 09:50:09 bunsen-honeydew sshd[54755]: Invalid user test from 219.237.242.171
Dec 3 09:50:11 bunsen-honeydew sshd[54757]: Invalid user guest from 219.237.242.171
Dec 3 09:50:13 bunsen-honeydew sshd[54759]: Invalid user webmaster from 219.237.242.171
Dec 3 09:50:17 bunsen-honeydew sshd[54763]: Invalid user oracle from 219.237.242.171
Dec 3 09:50:19 bunsen-honeydew sshd[54765]: Invalid user library from 219.237.242.171
Dec 3 09:50:22 bunsen-honeydew sshd[54767]: Invalid user info from 219.237.242.171
Dec 3 09:50:24 bunsen-honeydew sshd[54769]: Invalid user shell from 219.237.242.171
Dec 3 09:50:26 bunsen-honeydew sshd[54771]: Invalid user linux from 219.237.242.171
Dec 3 09:50:28 bunsen-honeydew sshd[54773]: Invalid user unix from 219.237.242.171
Dec 3 09:50:30 bunsen-honeydew sshd[54775]: Invalid user webadmin from 219.237.242.171
Dec 3 09:50:32 bunsen-honeydew sshd[54782]: Invalid user ftp from 219.237.242.171
Dec 3 09:50:34 bunsen-honeydew sshd[54784]: Invalid user test from 219.237.242.171
Dec 3 09:50:38 bunsen-honeydew sshd[54788]: Invalid user admin from 219.237.242.171
Dec 3 09:50:40 bunsen-honeydew sshd[54790]: Invalid user guest from 219.237.242.171
Dec 3 09:50:42 bunsen-honeydew sshd[54792]: Invalid user master from 219.237.242.171
Dec 3 09:50:44 bunsen-honeydew sshd[54794]: Invalid user apache from 219.237.242.171
Dec 3 09:51:00 bunsen-honeydew sshd[54810]: Invalid user admin from 219.237.242.171
Dec 3 09:51:02 bunsen-honeydew sshd[54812]: Invalid user admin from 219.237.242.171
Dec 3 09:51:04 bunsen-honeydew sshd[54814]: Invalid user admin from 219.237.242.171
Dec 3 09:51:06 bunsen-honeydew sshd[54816]: Invalid user admin from 219.237.242.171
Dec 3 09:51:12 bunsen-honeydew sshd[54822]: Invalid user test from 219.237.242.171
Dec 3 09:51:14 bunsen-honeydew sshd[54824]: Invalid user test from 219.237.242.171
Dec 3 09:51:16 bunsen-honeydew sshd[54826]: Invalid user webmaster from 219.237.242.171
Dec 3 09:51:18 bunsen-honeydew sshd[54828]: Invalid user turbo from 219.237.242.171
Dec 3 09:51:20 bunsen-honeydew sshd[54830]: Invalid user cvs from 219.237.242.171
Dec 3 09:51:22 bunsen-honeydew sshd[54832]: Invalid user ram from 219.237.242.171
Dec 3 09:51:24 bunsen-honeydew sshd[54834]: Invalid user eric from 219.237.242.171
Dec 3 09:51:26 bunsen-honeydew sshd[54836]: Invalid user wu from 219.237.242.171
Dec 3 09:51:28 bunsen-honeydew sshd[54838]: Invalid user jesica from 219.237.242.171
Dec 3 09:51:30 bunsen-honeydew sshd[54840]: Invalid user jessica from 219.237.242.171
Dec 3 09:51:32 bunsen-honeydew sshd[54842]: Invalid user hsiao from 219.237.242.171
Dec 3 09:51:34 bunsen-honeydew sshd[54844]: Invalid user chen from 219.237.242.171
Dec 3 09:51:36 bunsen-honeydew sshd[54846]: Invalid user sam from 219.237.242.171
Dec 3 09:51:38 bunsen-honeydew sshd[54848]: Invalid user chang from 219.237.242.171
Dec 3 09:51:40 bunsen-honeydew sshd[54850]: Invalid user alan from 219.237.242.171
Dec 3 09:51:42 bunsen-honeydew sshd[54852]: Invalid user allan from 219.237.242.171
Dec 3 09:51:44 bunsen-honeydew sshd[54854]: Invalid user web from 219.237.242.171
Dec 3 09:51:46 bunsen-honeydew sshd[54856]: Invalid user eva from 219.237.242.171
Dec 3 09:51:48 bunsen-honeydew sshd[54858]: Invalid user adam from 219.237.242.171
Dec 3 09:51:50 bunsen-honeydew sshd[54860]: Invalid user postgres from 219.237.242.171
Dec 3 09:51:52 bunsen-honeydew sshd[54862]: Invalid user postgres from 219.237.242.171
Dec 3 09:51:54 bunsen-honeydew sshd[54864]: Invalid user sam from 219.237.242.171
Dec 3 09:51:56 bunsen-honeydew sshd[54866]: Invalid user student from 219.237.242.171
Dec 3 09:51:58 bunsen-honeydew sshd[54868]: Invalid user student from 219.237.242.171
Dec 3 09:52:00 bunsen-honeydew sshd[54870]: Invalid user student from 219.237.242.171
Dec 3 09:52:02 bunsen-honeydew sshd[54872]: Invalid user eric from 219.237.242.171
Dec 3 09:52:04 bunsen-honeydew sshd[54874]: Invalid user fax from 219.237.242.171
Dec 3 09:52:06 bunsen-honeydew sshd[54876]: Invalid user test from 219.237.242.171
Dec 3 09:52:08 bunsen-honeydew sshd[54878]: Invalid user test from 219.237.242.171
Dec 3 09:52:10 bunsen-honeydew sshd[54881]: Invalid user test from 219.237.242.171
Dec 3 09:52:12 bunsen-honeydew sshd[54883]: Invalid user test from 219.237.242.171
Dec 3 09:52:14 bunsen-honeydew sshd[54885]: Invalid user test from 219.237.242.171
Dec 3 09:52:16 bunsen-honeydew sshd[54887]: Invalid user test from 219.237.242.171
Dec 3 09:52:18 bunsen-honeydew sshd[54889]: Invalid user test from 219.237.242.171
Dec 3 09:52:18 bunsen-honeydew sshd[54891]: Invalid user isanne from 201.218.231.142
Dec 3 09:52:18 bunsen-honeydew com.apple.SecurityServer[48]: Failed to authorize right system.login.tty by client /usr/sbin/sshd for authorization created by /usr/sbin/sshd.
Dec 3 09:52:18 bunsen-honeydew sshd[54891]: error: PAM: Authentication failure for illegal user isanne from 201.218.231.142
Dec 3 09:52:18 bunsen-honeydew sshd[54891]: Failed keyboard-interactive/pam for invalid user isanne from 201.218.231.142 port 2356 ssh2
Dec 3 09:52:20 bunsen-honeydew sshd[54894]: Invalid user test from 219.237.242.171
Dec 3 09:52:22 bunsen-honeydew sshd[54896]: Invalid user test from 219.237.242.171
Dec 3 09:52:24 bunsen-honeydew sshd[54898]: Invalid user test from 219.237.242.171
Dec 3 09:52:26 bunsen-honeydew sshd[54900]: Invalid user info from 219.237.242.171
Dec 3 09:52:28 bunsen-honeydew sshd[54902]: Invalid user lsmith from 219.237.242.171
Dec 3 09:52:30 bunsen-honeydew sshd[54904]: Invalid user lsmith from 219.237.242.171
Dec 3 09:52:32 bunsen-honeydew sshd[54906]: Invalid user dennison from 219.237.242.171
Dec 3 09:52:34 bunsen-honeydew sshd[54908]: Invalid user dennison from 219.237.242.171
Dec 3 09:52:36 bunsen-honeydew sshd[54910]: Invalid user chris from 219.237.242.171
Dec 3 09:52:38 bunsen-honeydew sshd[54912]: Invalid user chriss from 219.237.242.171
Dec 3 09:52:40 bunsen-honeydew sshd[54914]: Invalid user user from 219.237.242.171
Dec 3 09:52:42 bunsen-honeydew sshd[54916]: Invalid user username from 219.237.242.171
Dec 3 09:52:44 bunsen-honeydew sshd[54918]: Invalid user username from 219.237.242.171
Dec 3 09:52:46 bunsen-honeydew sshd[54920]: Invalid user user from 219.237.242.171
Dec 3 09:52:50 bunsen-honeydew sshd[54924]: Invalid user admin from 219.237.242.171
Suddenly, the request rate jumped radically, from one every few minutes, to one every few seconds, and all from the same IP address. Well, they're nothing if not persistent. Can anybody diagnose the "Failed keyboard-interactive/pam for invalid user" line? After I set PasswordAuthentication to "no", I thought those sorts of things wouldn't happen any more.
Previous Topic
Index
