I have a raspberry-pi (running GNU/Linux) and I recently allowed my router to forward port 22 (ssh) to the raspberry-pi so that I could log in while away from home. I then noticed a bunch of apparent break-in attempts (failed root logins coming from a chinese ip address) in auth.log, and I have a couple questions about the timing of the failed root logins. Here's a snippet from my /var/log/auth.log file (the first number is just the line number from vi): 5966 Sep 7 11:50:19 raspberrypi sshd[13759]: Failed password for root from 122.225.103.125 port 34328 ssh2 5967 Sep 7 11:50:20 raspberrypi sshd[13755]: Failed password for root from 122.225.103.125 port 32582 ssh2 5968 Sep 7 11:50:20 raspberrypi sshd[13763]: Failed password for root from 122.225.103.125 port 35381 ssh2 5969 Sep 7 11:50:21 raspberrypi sshd[13759]: Failed password for root from 122.225.103.125 port 34328 ssh2 5970 Sep 7 11:50:22 raspberrypi sshd[13763]: Failed password for root from 122.225.103.125 port 35381 ssh2 5971 Sep 7 11:50:24 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2 5972 Sep 7 11:50:24 raspberrypi sshd[13763]: Failed password for root from 122.225.103.125 port 35381 ssh2 5973 Sep 7 11:50:25 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2 5974 Sep 7 11:50:26 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2 5975 Sep 7 11:50:26 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2 5976 Sep 7 11:50:28 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2 5977 Sep 7 11:50:28 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2 5978 Sep 7 11:50:29 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2 5979 Sep 7 11:50:31 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2 5980 Sep 7 11:50:31 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2 5981 Sep 7 11:50:31 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2 5982 Sep 7 11:50:33 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2 5983 Sep 7 11:50:33 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2 5984 Sep 7 11:50:34 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2 5985 Sep 7 11:50:35 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2 5986 Sep 7 11:50:35 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2 5987 Sep 7 11:50:36 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2 5988 Sep 7 11:50:37 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2 5989 Sep 7 11:50:38 raspberrypi sshd[13779]: Failed password for root from 122.225.103.125 port 46112 ssh2 5990 Sep 7 11:50:39 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2 And, here's a snippet from my /etc/pam.d/login file (the first number is just the line number from vi): 9 auth optional pam_faildelay.so delay=3000000 As you can see the delay is set in pam.d/login to three seconds... However the failed root logins are coming at about 1 second apart. How is this possible? Is it because the logins are coming from different ports or ttys? Also, when I try to emulate this behavior myself by putting in the wrong root password, I find that after three attempts I get disconnected and this shows up in auth.log like: 231 Sep 17 11:51:57 raspberrypi sshd[17591]: Failed password for root from 192.168.42.71 port 34208 ssh2 232 Sep 17 11:52:01 raspberrypi sshd[17591]: Failed password for root from 192.168.42.71 port 34208 ssh2 233 Sep 17 11:52:04 raspberrypi sshd[17591]: Failed password for root from 192.168.42.71 port 34208 ssh2 234 Sep 17 11:52:04 raspberrypi sshd[17591]: Connection closed by 192.168.42.71 [preauth] My three failed attempts are spaced out by at least 3 seconds (as specified in pam.d/login). How is it possible for whoever is trying to break in to make more that one attempt every three seconds and why is the connection not being closed after three failed attempts? Any help understanding this behavior would be greatly appreciated. Feel free to give references if you are not in the mood to type out an answer. Oh, also, if anyone has any idea as to how my ip address was targeted or if it is just random, I would be interested to hear about it.