[asterisk-users] Do you think my server is being attacked?

[Steve Edwards]

On Fri, 14 May 2010, bruce bruce wrote:

> Are these indications of attacks on this system? I specifically have 
> port 22 disabled at all times and only port forward it to server when I 
> access SSH for a minute or so. Shouldn't UNKNOWN be an actual IP 
> address?
> 
> /var/log/secure:
> 
> May 14 00:35:39 pbx sshd[9011]: Did not receive identification string from UNKNOWN
> May 14 00:36:09 pbx sshd[9040]: Did not receive identification string from UNKNOWN

Not an Asterisk question.

If you had asked Google, you may have seen (second result from my Google 
query) a post ("http://www.freepbx.org/v2/ticket/3461") about FreePBX 
scanning port 22 every thirty seconds.

Maybe this is what you are seeing.

-- 
Thanks in advance,
-------------------------------------------------------------------------
Steve Edwards       sedwards at sedwards.com      Voice: +1-760-468-3867 PST
Newline                                              Fax: +1-760-731-3000