Re: [bitfolk] default behaviour of Debian /etc/login.defs does not log to /var/log/sulog

Hi Max, On Sun, Nov 10, 2013 at 09:46:35PM +0000, Max B wrote: If by "attempts", you mean SSH login tries, then: Most of my hosts have SSH login attempts from this IP on hundreds of different user names and that is with Fail2Ban operating. Without it I wouldn't be surprised to see thousands or tens of thousands of attempts. Looks very much like a typical compromised box doing SSH dictionary attacks. I would not consider this targeted at any individual site or host, unless there is something else you aren't mentioning. The registrar and hosting arrangements don't appear unusual for a large proportion of domain names out there. You will probably never establish whether it's someone server that's been compromised or someone's server that was bought for nefarious purposes, but assuming they have a special interest in you is in my opinion going too far based on evidence provided. Cheers, Andy -- http://bitfolk.com/ -- No-nonsense VPS hosting