Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Increase in ssh root access attempts - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Increase in ssh root access attempts

We've received a few notes today about a recent increase in attempts to log in as root via ssh.

The activity graph confirms this activity as well as another spike toward the end of last month.

If you allow remote root logins (bad!), you'll want to check your systems.

I'm sure we'll here more on this topic when port 22 is discussed for Cyber Security Awareness Month


Christopher Carboni - Handler On Duty


140 Posts
Oct 1st 2009
I've noticed this also, and it's pretty odd. Looking at my logs, I've averaged 0 ssh root access attempts per day for the past two months. On Wed there were 875, on Thurs 1789, and 456 so far today. 722 unique sources.

Sign Up for Free or Log In to start participating in the conversation!