[ml] worm ssh ?

Questa mattina ho trovato nei log i seguenti messaggi:

Jul 27 01:22:30 sidney sshd[22961]: Illegal user test from
128.164.159.199
Jul 27 01:22:32 sidney sshd[22961]: error: Could not get shadow
information for NOUSER
Jul 27 01:22:32 sidney sshd[22961]: Failed password for illegal user
test from 128.164.159.199 port 38977 ssh2
Jul 27 01:22:33 sidney sshd[22963]: User guest not allowed because shell
/dev/null is not executable
Jul 27 01:22:33 sidney sshd[22963]: error: Could not get shadow
information for NOUSER
Jul 27 01:22:33 sidney sshd[22963]: Failed password for illegal user
guest from 128.164.159.199 port 39062 ssh2

al momento ho disabilitato l'accesso keyboard.

googlando ho trovato:

http://www.mail-archive.com/debian-user@xxxxxxxxxxxxxxxx/msg110879.html
http://www.dslreports.com/forum/remark,10854834~mode=flat~days=9999
http://www.incidents.org/diary.php?date=2004-07-23
http://www.incidents.org/diary.php?date=2004-07-25


cheers,
 Enrico Rubboli.