How to Analyzing malicious SSH login attempts and secure the system

last updated in Categories Linux, Security

Using honeypot you can monitor and learn more about malicious SSH login.

From the article:
Malicious SSH login attempts have been appearing in some administrators’ logs for several years. This article revisits the use of honeypots to analyze malicious SSH login attempts and see what can be learned about this activity. The article then offers recommendations on how to secure one’s system against these attacks.

Read more at securityfocus

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

Share this on (or read 1 comments/add one below):

1 comment

  1. A honeypot isn’t even needed – an active web server with logging enabled seems to attract *plenty* of malicious login attempts. Provided the server is hardened well enough to avoid compromise, this may yield more accurate results than a honeypot that many adversaries recognize.

    Have a question? Post it on our forum!