This is a discussion on sshd[29286]: Bad protocol version identification '0' from 127.0.0.1 within the Linux Security forums, part of the System Security and Security Related category; Just wondering if anyone knows what could be causing this error message in the sshd logs: $ sudo grep 'Bad protocol' /...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
Just wondering if anyone knows what could be causing this error message
in the sshd logs: $ sudo grep 'Bad protocol' /var/log/auth.log Nov 7 00:48:32 starke sshd[29286]: Bad protocol version identification '0' from 127.0.0.1 Nov 7 02:33:11 starke sshd[31438]: Bad protocol version identification '0' from 127.0.0.1 Nov 7 02:49:53 starke sshd[14860]: Bad protocol version identification '0' from 127.0.0.1 Nov 7 03:19:41 starke sshd[12458]: Bad protocol version identification '0' from 127.0.0.1 Nov 7 03:19:57 starke sshd[12534]: Bad protocol version identification '0' from 127.0.0.1 Nov 7 05:19:35 starke sshd[20021]: Bad protocol version identification '0' from 127.0.0.1 The only reference i found to this on google was a local exploit in logwatch http://www.securiteam.com/exploits/5SP032A6US.html from 2002 but I am not running logwatch but am using logcheck on debian sarge. Using telnet I checked out how I could reproduce it and by telneting over ssh from the localhost and just typing 0 once connected I get the same error message. I have no idea what would be doing that though and whether or not it could be someone attempting and exploit. $telnet localhost 22 $tail -f /var/log/auth.log Nov 7 08:57:21 starke sshd[4796]: Bad protocol version identification '0' from 127.0.0.1 Thanks for any help John The last line was |