What SSH Hacking Attempts Look Like

Re:What SSH Hacking Attempts Look Like by zAy0LfpBZLC8mAC on Saturday May 05, 2018 @10:23AM (#17001918)

Except actual attacks don't show up in logs anyway, so it's still pointless?

The SSH daemon logs when it successfully rejects an access. A successfully rejected access is inconsequential to your security. If you are using secure passwords or pubkey authentication, it will never log a successful login by an attacker. What remains then is exploitation of the SSH server ... but the SSH server doesn't have a code path that logs "I have been exploited".

[ Parent | on HN ]

Re:What SSH Hacking Attempts Look Like by A2017U1 on Sunday May 06, 2018 @01:24AM (#17005341)

/etc/sshrc executes before a successful ssh login, you can use that to be notified before an attacker has any access to log files

[ Parent | on HN ]

Re:What SSH Hacking Attempts Look Like by zAy0LfpBZLC8mAC on Sunday May 06, 2018 @07:38AM (#17006061)

... so? How does that contradict what I wrote?

[ Parent | on HN ]