Groups > linux.debian.user > #219404

Re: Connection closed by [IP] port [port] [preauth]

From	john doe <johndoe65534@mail.com>
Newsgroups	linux.debian.user
Subject	Re: Connection closed by [IP] port [port] [preauth]
Date	2020-02-24 22:10 +0100
Message-ID	<zDt9g-7JC-5@gated-at.bofh.it> (permalink)
References	<zDsGe-7jU-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 2/24/2020 9:38 PM, steve wrote:
> Hi there,
>
> Since February 11th at 00:25:09, I am getting the following every 12
> secondes:
>
> Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120
> port 54422 [preauth]
>
> And when I say every 12 seconds, it is really every 12 seconds, and this
> is now going on for more than 13 days, without any interruption. At the
> beginning, I thought that this was just standards nmap scans or
> something similar and so didn't bother taking any action. But now I'm
> asking myself who (in China) would be so stupid to continue this
> scanning.
>
> What should I do? Send an email to the abuse contact? Ignore it and wait
> that it's over? It doesn't seem naughty but it's getting irritating.
>

Find a way to block/ban this address, fail2ban, firewall and to some
extend sshd_config.

--
John Doe

Thread

Connection closed by [IP] port [port] [preauth] steve <dlist@bluewin.ch> - 2020-02-24 21:40 +0100
  Re: Connection closed by [IP] port [port] [preauth] Dan Ritter <dsr@randomstring.org> - 2020-02-24 22:00 +0100
    Re: Connection closed by [IP] port [port] [preauth] steve <dlist@bluewin.ch> - 2020-02-26 07:10 +0100
  Re: Connection closed by [IP] port [port] [preauth] john doe <johndoe65534@mail.com> - 2020-02-24 22:10 +0100
  Re: Connection closed by [IP] port [port] [preauth] Tixy <tixy@yxit.co.uk> - 2020-02-25 07:50 +0100
    Re: Connection closed by [IP] port [port] [preauth] deloptes <deloptes@gmail.com> - 2020-02-26 08:00 +0100
      Re: Connection closed by [IP] port [port] [preauth] Klaus Singvogel <deb-user-ml@singvogel.net> - 2020-02-26 08:50 +0100
        Re: Connection closed by [IP] port [port] [preauth] Didar Hossain <didar@purlo.in> - 2020-02-29 10:00 +0100

csiph-web