Massive ssh annoyance

My logfiles are totally full of logged connection-attempts to my servers. It looks like people are trying to exploit the ssh-vulnerability which became known some days ago (“openssh denial of service CVE-2006-4924“).

The logfiles are full of messages like:

Jul 26 08:03:29 wormhole sshd[14229]: Bad protocol version identification ‘\243\361^G\216\325\325\320\370k\301\3044\33134\374\350\274K21′ from 71.202.54.119
Jul 26 08:03:35 wormhole sshd[14252]: Bad protocol version identification ‘\315yh$30\205\271\214\204\346k!’ from 67.68.199.28
Jul 26 08:04:34 wormhole sshd[15445]: Bad protocol version identification ‘23BitTorrent protocol’ from 87.89.44.247

I’m only guessing that this is an exploit to the vulnerabilities of SSH protocol version 1. However, this attacks are really massive, massive like:

# grep “Bad protocol” auth.log | wc -l
24404
# grep “Bad protocol.* from ” auth.log | awk ‘{print $NF}’ | sort | uniq | wc -l
4342

I got SSH protocol version 1 disabled by default, so this ain’t no real threat to me, but the scale of this attacks causes a DOS on my servers; the sshd is that busy that I, as a legetimate user, fail to log in any now and then:

$ ssh wormhole.ynfonatic.de
ssh_exchange_identification: Connection closed by remote host

And that’s exactly the point where i get angry. However, this attack is distributed over the whole internet so i can’t filter on specific IP-addresses. *sigh*

Tech Tags: Security