Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Request for logs please.

So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH username lists by country?"

I happen to think that this would be an interesting little project and would like to do some research but to make this a statistically useful exercise will require access to more logs than I have.

So, would any of you be willing to share SSH logs for failed passwords /invalid users?

The logs would need to contain the source IP and enough verbose detail for me to see either a failed password attempt or an invalid user name used.

share|improve this question
1  
Good luck with getting people to hand over these logs... ;) –  Steve Dec 17 '10 at 16:29
    
Given enough time to sanitize them, maybe. There are existing lists like this out there in various forms of public accessibility. –  Scott Pack Dec 17 '10 at 16:59
1  
Not asking for anything sensitive - as an example this is one of the logs being sent to me for this project: Dec 17 12:56:11 cronos sshd[25122]: Failed password for root from 66.11.xxx.xxx port 46635 ssh2 –  David Stubley Dec 17 '10 at 17:48
add comment

1 Answer

Like Project Honeypot?

These are spam harvesters, but the idea is the same. By country

share|improve this answer
    
useful links - cheers. –  Rory Alsop Jan 10 '11 at 16:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.