On Mon, 16 May 2005 18:45:29 +0300, Kaj Mdkinen <[EMAIL PROTECTED]> wrote:
>I connect to my firewall with putty. How can I get rid of messages like >these from >appearing in my ssh terminal session? These appeared twice a second so >it is wery hard to >work with the console. >(It was obviously someone trying to get access to something?) > >May 16 18:30:05 localhost sshd[21201]: Failed password for root from >64.42.53.150 port 48385 ssh2 >May 16 18:30:06 localhost sshd[21201]: Received disconnect from >64.42.53.150: 11: Bye Bye >May 16 18:30:08 localhost sshd[12553]: Failed password for root from >64.42.53.150 port 48446 ssh2 >May 16 18:30:08 localhost sshd[12553]: Received disconnect from >64.42.53.150: 11: Bye Bye >May 16 18:30:11 localhost sshd[23351]: Failed password for root from >64.42.53.150 port 48543 ssh2 >May 16 18:30:11 localhost sshd[23351]: Received disconnect from >64.42.53.150: 11: Bye Bye >May 16 18:30:14 localhost sshd[13243]: Failed password for root from >64.42.53.150 port 48628 ssh2 First of all, do not log in as root. Use sudo. And if you're smart, disable root ssh access. Second, the messages are the result of a brute force attack on your system. They are most likely going after your root password since you have ssh for it enabled. Add the offenders IP address to your pf block list. JCR
