Re: [gentoo-user] Usernames in ssh attacks

[Paul Hartman]

On Thu, Mar 19, 2009 at 10:36 AM, Johan Blåbäck
<johan.bluecreek@×××××.com> wrote:
> I've always had usernames when it comes to sshd's log entries in
> auth.log, like the following:
>
> <time> <hostname> sshd[5926]: error: PAM: Authentication failure for
> <username> from <ip-adress>

Well, I don't use PAM, just key-based authentication only, so I always
see only the IP getting rejected since it doesn't even give them a
place to try a user/password :) It's just weird that it is refusing a
connection from user@domain rather than simply the IP. I guess they
could be trying to ssh user@××××××.net or something.  The one with
[U2FsdGVkX19g32YZVKMsQkl+mouWITILOicY4Iq9OQo=] as the username is
interesting. I wonder what that's all about.