Darrell Shandrow said the following on Tue, Jan 22, 2002 at 08:43:41PM -0700: > Hi Raul, > > Hmmm, looks like a rather persistent port scan, in my estimation. > > At 11:04 PM 1/20/2002 -0600, you wrote: > >Hey gang. I received this log entry and am not sure if it's a portscan > >of some type or not. Anyone seen this before? > > > >Jan 20 19:23:25 saidin sshd[4209]: scanned from 195.178.168.129 with > >+SSH-1.0-SSH_Version_Mapper. Don't panic. > >Jan 20 19:24:47 saidin sshd[4216]: scanned from 195.178.168.129 with > >+SSH-1.0-SSH_Version_Mapper. Don't panic. > >Jan 20 19:26:00 saidin sshd[4220]: scanned from 195.178.168.129 with > >+SSH-1.0-SSH_Version_Mapper. Don't panic. I thought so at first but usually portscans will scan more ports than ssh. Besides I'm not worried about anyone breaking in via ssh. My ssh is secure and does not allow root to ssh in anyway. I also didn't see any other portscans on any other ports. What it seems to me is that they were trying to use ssh1 to connect on ssh2 or something but who knows. It has not happened since so I am not worried. -- We are writing this e-mail to inform you that the mail server is down. Please do not call the help desk for assistance. To see the progress of any outage refer to your e-mail notifications. Raul A. Gallegos - http://www.asmodean.net
