8

Request for logs please.

So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH username lists by country?"

I happen to think that this would be an interesting little project and would like to do some research but to make this a statistically useful exercise will require access to more logs than I have.

So, would any of you be willing to share SSH logs for failed passwords /invalid users?

The logs would need to contain the source IP and enough verbose detail for me to see either a failed password attempt or an invalid user name used.

Improve this question
3
  • 2
    Good luck with getting people to hand over these logs... ;)
    – Steve
    Commented Dec 17, 2010 at 16:29
  • Given enough time to sanitize them, maybe. There are existing lists like this out there in various forms of public accessibility.
    – Scott Pack
    Commented Dec 17, 2010 at 16:59
  • 1
    Not asking for anything sensitive - as an example this is one of the logs being sent to me for this project: Dec 17 12:56:11 cronos sshd[25122]: Failed password for root from 66.11.xxx.xxx port 46635 ssh2
    – David Stubley
    Commented Dec 17, 2010 at 17:48

1 Answer 1

Reset to default
3

Like Project Honeypot?

These are spam harvesters, but the idea is the same. By country

Improve this answer
1
  • useful links - cheers.
    – Rory Alsop ♦
    Commented Jan 10, 2011 at 16:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .