Re: Reporting SSH abuse

[mgk <mgk.mailing () googlemail com>]

Hi

We take reports like this seriously when we receive them and take them 
up with customers.  Theres no harm in sending a report with some logs. 
Wording such as, it seems as though this is the situation is less 
confrontational than, Attacks are coming from your network, sort it out.

Here are a few we have had:-

Looks like your custommer with IP xxxxxxxxx is doing ssh attacks to my 
server.
Please take care about
 Best Regards

and

Hi,

one of your servers doesn't seem to be under the users control anymore.

Source IP: xxxxxx
Destination IP: xxxxx
Port: 22
Abuse: Brute-Force attacks on SSH
Times: all times are in CET/MEZ (UTC +1)
Log-excerpt: please find the log excerpt below

Dec 26 13:58:19 axel86 sshd[11661]: Did not receive identification 
string from xxxxxxx

/Mgk


On 09/03/2010 18:37, Dan Pilcheck wrote:
> Hello list,
>
> I've been getting a slew of SSH brute forces coming from a university
> inside the US over the
> past week. Normally I wouldn't even bother with reporting, but I
> figured this would be a
> chance to clear this up.
>
> Fail2ban bans for 10 hours, and then the login attempts area right
> back at it. Repeat.
>
> An email with associated logs, and perhaps a little info from this
> side is the best I can come
> up with. I suppose there's not much else to report, though.
>
> Is there a 'standard' format to report ssh abuse? Like there is with
> vuln reporting?
>
> IMO, I doubt anything will happen, but if it were coming from my
> network, I'd like a notification.


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------