8

Request for logs please.

So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH username lists by country?"

I happen to think that this would be an interesting little project and would like to do some research but to make this a statistically useful exercise will require access to more logs than I have.

So, would any of you be willing to share SSH logs for failed passwords /invalid users?

The logs would need to contain the source IP and enough verbose detail for me to see either a failed password attempt or an invalid user name used.

  • 2
    Good luck with getting people to hand over these logs... ;) – Steve Dec 17 '10 at 16:29
  • Given enough time to sanitize them, maybe. There are existing lists like this out there in various forms of public accessibility. – Scott Pack Dec 17 '10 at 16:59
  • 1
    Not asking for anything sensitive - as an example this is one of the logs being sent to me for this project: Dec 17 12:56:11 cronos sshd[25122]: Failed password for root from 66.11.xxx.xxx port 46635 ssh2 – David Stubley Dec 17 '10 at 17:48
3

Like Project Honeypot?

These are spam harvesters, but the idea is the same. By country

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.