Ich liebe diese Scriptkiddies:

Nov 14 20:26:59 yoga sshd[29598]: Invalid user test from 200.254.66.195
Nov 14 20:27:01 yoga sshd[29600]: Invalid user test1 from 200.254.66.195
Nov 14 20:27:04 yoga sshd[29602]: Invalid user teste from 200.254.66.195
Nov 14 20:27:08 yoga sshd[29604]: Invalid user admin from 200.254.66.195
Nov 14 20:27:20 yoga sshd[29610]: Invalid user webmaster from 200.254.66.195
Nov 14 20:27:23 yoga sshd[29612]: Invalid user web from 200.254.66.195
Nov 14 20:27:25 yoga sshd[29614]: Invalid user http from 200.254.66.195
Nov 14 20:27:29 yoga sshd[29616]: Invalid user httpd from 200.254.66.195
Nov 14 20:27:32 yoga sshd[29618]: Invalid user www from 200.254.66.195
Nov 14 20:27:35 yoga sshd[29620]: Invalid user www1 from 200.254.66.195
Nov 14 20:27:47 yoga sshd[29629]: Invalid user ftpuser from 200.254.66.195
Nov 14 20:27:50 yoga sshd[29631]: Invalid user data from 200.254.66.195
Nov 14 20:27:52 yoga sshd[29633]: Invalid user oracle from 200.254.66.195
Nov 14 20:27:59 yoga sshd[29637]: Invalid user user from 200.254.66.195
Nov 14 20:28:08 yoga sshd[29643]: Invalid user install from 200.254.66.195
Nov 14 20:28:13 yoga sshd[29647]: Invalid user linux from 200.254.66.195
Nov 14 20:28:19 yoga sshd[29651]: Invalid user service from 200.254.66.195
Nov 14 20:28:25 yoga sshd[29655]: Invalid user demo from 200.254.66.195
Nov 14 20:28:36 yoga sshd[29665]: Invalid user password from 200.254.66.195
Nov 14 20:28:44 yoga sshd[29669]: Invalid user pass from 200.254.66.195
Nov 14 20:28:53 yoga sshd[29673]: Invalid user system from 200.254.66.195
Nov 14 20:28:55 yoga sshd[29675]: Invalid user temp from 200.254.66.195
Nov 14 20:29:01 yoga sshd[29679]: Invalid user fedora from 200.254.66.195
Nov 14 20:29:03 yoga sshd[29681]: Invalid user falcon from 200.254.66.195
Nov 14 20:29:11 yoga sshd[29687]: Invalid user cocolino from 200.254.66.195
Nov 14 20:30:10 yoga sshd[29754]: Invalid user design from 200.254.66.195
Nov 14 20:30:16 yoga sshd[29759]: Invalid user public from 200.254.66.195
....


Dumm, dass wir nur public-key auth auf SSH Ebene erlauben. Trotzdem landet die IP in meiner Blacklist, versaut einen ja doch die Logs 🙂