Constant SSH hacking attempts?

[duncan]

Hi guys,

Just wondering if everyone has this 'problem' - it seems my server is always being hit by SSH hacking attempts. They are usually just library attacks, which are pretty harmless.. but they are very persistent.

I consider it a "good day" if I have under 200 attempts.

Is this normal, or am I somehow sending out a beacon? Aside from having good passwords, is there any additional steps that I should really be taking?

Thanks!

Duncan

 

[RackSystems]

This is not normal, it can be that some botnet is scanning your IP Range, over and over again....

I would contact my isp, and tell him about this problem, maybe he can filter out some ip's or send some abuse mails. Ohterwise this will keep continuing.

 

[jmstacey]

If the attacks are always comming from the same IP or class, you could also temporarily block them for a few days using your firewall.

 

[nobaloney]

Library ssh hacking attempts are fairly common.

Jeff