secure.log unknown IP found ??

[sathish]

Hello all,

While I seeing by secure.log files.. I have a seen an unknown ip in the log.

1) Apr  2 13:24:36 (host name) sshd[3952]: Did not receive identification string from 24.116.152.154.

2) Mar 30 01:42:30 (host name)  sshd[6103]: Did not receive identification string from 211.250.27.250.

3) Mar 30 19:31:23 (host name) sshd[752]: Server listening on 0.0.0.0 port 22.

(host name) - is my system after sshd(3952, 6103 & 752) what it indicates ??

(1&2) - Is from that  2 IP is trying to hack my system in ssh mode.. Is they successful in logged in to my  sys ?? what do you mean by (Did not receive identification string)

3) It is always listening to port address max log filled by listening to that port. How to stop it ??


Please let me know the results...


Thank you,
Sathish

[engineerjude]

I guess someone who knows your Linux server root access and Ip's has attempted to login to your Linux server using 'putty' and as a result, each time he/she enters your linux server, the ip address of the remote network he is will appear on the last login screen.