[SOLVED]less sshd logging

Kotrfa · 2014-05-26 18:57:55

Hello,

I have problem with ssh on my mini server, which is used just for few websites. It it still under ssh attacks and it starts to be really anoying. The biggest problem is with sshd logging. Journalctl is only enabled to has maximum 5MB (it is stored in RAM) and then it is rotated (I keep 3 backups). Unfrotunately, because of all sshd brutal force requests, the log is showing something like this in 90% of it's content:

May 26 19:09:38 smecpi sshd[25997]: pam_unix(sshd:auth): check pass; user unknown
May 26 19:09:41 smecpi sshd[25997]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.204
May 26 19:09:41 smecpi sshd[25997]: PAM service(sshd) ignoring max retries; 6 > 3
May 26 19:09:44 smecpi sshd[26001]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:09:45 smecpi sshd[26001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.
May 26 19:09:45 smecpi sshd[26006]: pam_tally(sshd:auth): pam_get_uid; no such user
May 26 19:09:45 smecpi sshd[26006]: pam_unix(sshd:auth): check pass; user unknown
May 26 19:09:45 smecpi sshd[26006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.
May 26 19:09:47 smecpi sshd[26006]: pam_tally(sshd:auth): pam_get_uid; no such user
May 26 19:09:47 smecpi sshd[26006]: pam_unix(sshd:auth): check pass; user unknown
May 26 19:09:47 smecpi sshd[26001]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:09:49 smecpi sshd[26006]: pam_tally(sshd:auth): pam_get_uid; no such user
May 26 19:09:49 smecpi sshd[26006]: pam_unix(sshd:auth): check pass; user unknown
May 26 19:09:49 smecpi sshd[26001]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:09:52 smecpi sshd[26006]: pam_tally(sshd:auth): pam_get_uid; no such user
May 26 19:09:52 smecpi sshd[26006]: pam_unix(sshd:auth): check pass; user unknown
May 26 19:09:52 smecpi sshd[26001]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:09:54 smecpi sshd[26006]: pam_tally(sshd:auth): pam_get_uid; no such user
May 26 19:09:54 smecpi sshd[26006]: pam_unix(sshd:auth): check pass; user unknown
May 26 19:09:55 smecpi sshd[26001]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:09:57 smecpi sshd[26006]: pam_tally(sshd:auth): pam_get_uid; no such user
May 26 19:09:57 smecpi sshd[26006]: pam_unix(sshd:auth): check pass; user unknown
May 26 19:09:58 smecpi sshd[26001]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:09:58 smecpi sshd[26006]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.204
May 26 19:09:58 smecpi sshd[26006]: PAM service(sshd) ignoring max retries; 6 > 3
May 26 19:09:59 smecpi sshd[26024]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:09:59 smecpi sshd[26019]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:09:59 smecpi sshd[26019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.
May 26 19:09:59 smecpi sshd[26024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.
May 26 19:10:00 smecpi sshd[26001]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.10.191.204  user
May 26 19:10:00 smecpi sshd[26001]: PAM service(sshd) ignoring max retries; 6 > 3
May 26 19:10:01 smecpi sshd[26019]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:10:01 smecpi sshd[26024]: pam_tally(sshd:auth): Tally overflowed for user root
May 26 19:10:02 smecpi sshd[26028]: pam_tally(sshd:auth): pam_get_uid; no such user
May 26 19:10:02 smecpi sshd[26028]: pam_unix(sshd:auth): check pass; user unknown

I tried to add "-q" switch to sshd service:

● sshd.service - OpenSSH Daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)
   Active: active (running) since Mon 2014-05-26 08:58:59 CEST; 11h ago
 Main PID: 24483 (sshd)
   CGroup: /system.slice/sshd.service
           └─24483 /usr/bin/sshd -qD

but it didn't help a lot. Then I try "-E" switch, but that is just for debug purpouses. Appart from that, I tried to set up sshguard (without success unfortunately), had to erase btmp and allows access to root via ssh only with pubkey.

It annoys me because when I'm trying to find something useful (for example cron's jobs reports) it is already deleted (thanks to small size of files) or lost in the middle of this stupidities.

Any ideas?
Thank you

Last edited by Kotrfa (2014-05-28 19:24:17)

ANOKNUSA · 2014-05-26 19:16:19

1) What port do you use for SSH requests? If it's port 22, change it.

2) Disable password logins, and just use SSH keys. Any person or bot trying to log in without an authorized key will be immediately rejected rather than going through the authentication process; trying to log in repeatedly will be utterly pointless, and provided the person or bot is moderately smart they'll give up right away.

3) I've never used sshguard (or fail2ban, a similar program), but it would be wiser to continue trying to get those working. Hiding the fact that something's wrong doesn't change that fact. Start a thread explaining what you've tried to get those working so far, and see what help the community can offer.

As it is, what you're asking for is the computer equivalent of yanking the batteries out of a beeping smoke detector. The fact that you're not being told a problem exists doesn't make the problem go away.

ewaller · 2014-05-26 19:29:49

Adding to ANOKNUSA has said. I have both SSH keys and Password enabled. I keep the passwords enabled for certain use cases that are important to me. I have used both Fail2Ban and sshguard and both work well. I currently use sshguard because it is easier to maintain and is very fast. I strongly endorse its use. Also, for $DEITY's sake, turn off the ability of root to log in over ssh. IMHO, root should only be able to log in at the console.

WonderWoofy · 2014-05-26 22:14:51

Adding to what ANOKNUSA and ewaller stated above. It would indeed be ideal if you could use only ssh keys. But on my little server, my family also has access to it and many connect from a variety of devices. So I unfortunately also have to keep passwords enabled. I have found though that if I simply turn off the password login globally, then use a 'Match User' or 'Match Group' section to reenable password logins for specific usernames or groups, then it appears to a brute force attacker that it will only accept ssh keys (unless they guess the username correctly).

ewaller wrote:

Also, for $DEITY's sake, turn off the ability of root to log in over ssh. IMHO, root should only be able to log in at the console.

This times infinity...

ewaller · 2014-05-26 23:59:16

By the way, in the event anyone does not believe this is a problem, or as some would assert "fictitious nonsense", here is a history of attacks on my system that have been blocked by sshguard:

ewaller$@$odin /etc 1041 %journalctl $(which sshguard) --no-pager
-- Logs begin at Fri 2014-04-18 12:54:48 PDT, end at Mon 2014-05-26 16:53:48 PDT. --
Apr 22 05:09:36 odin sshguard[487]: Blocking 110.45.244.147:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
Apr 22 15:44:19 odin sshguard[487]: Blocking 1.93.32.185:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
Apr 23 10:47:16 odin sshguard[487]: Blocking 222.242.105.93:4 for >630secs: 40 danger in 4 attacks over 13 seconds (all: 40d in 1 abuses over 13s).
Apr 23 13:56:30 odin sshguard[487]: Blocking 221.120.224.180:4 for >630secs: 40 danger in 4 attacks over 21 seconds (all: 40d in 1 abuses over 21s).
Apr 23 19:30:10 odin sshguard[487]: Blocking 95.211.128.34:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
Apr 23 22:33:03 odin sshguard[487]: Blocking 61.174.51.222:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
Apr 24 00:29:47 odin sshguard[487]: Blocking 221.228.197.110:4 for >630secs: 40 danger in 4 attacks over 17 seconds (all: 40d in 1 abuses over 17s).
Apr 24 00:38:45 odin sshguard[487]: Blocking 202.191.132.203:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
Apr 24 01:03:34 odin sshguard[487]: Blocking 202.191.132.203:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 1494s).
Apr 24 01:30:24 odin sshguard[487]: Offender '202.191.132.203:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
Apr 24 01:30:24 odin sshguard[487]: Blocking 202.191.132.203:4 for >0secs: 40 danger in 4 attacks over 5 seconds (all: 120d in 3 abuses over 3104s).
Apr 24 07:11:07 odin sshguard[487]: Blocking 117.34.91.170:4 for >630secs: 40 danger in 4 attacks over 19 seconds (all: 40d in 1 abuses over 19s).
Apr 24 13:59:18 odin sshguard[487]: Blocking 174.120.123.90:4 for >630secs: 40 danger in 4 attacks over 15 seconds (all: 40d in 1 abuses over 15s).
Apr 24 14:36:35 odin sshguard[487]: Blocking 220.177.198.33:4 for >630secs: 40 danger in 4 attacks over 18 seconds (all: 40d in 1 abuses over 18s).
Apr 24 23:30:07 odin sshguard[487]: Blocking 42.62.17.250:4 for >630secs: 40 danger in 4 attacks over 17 seconds (all: 40d in 1 abuses over 17s).
Apr 25 02:02:02 odin sshguard[487]: Blocking 42.62.17.250:4 for >945secs: 40 danger in 4 attacks over 14 seconds (all: 80d in 2 abuses over 9132s).
Apr 25 07:43:23 odin sshguard[487]: Blocking 84.238.188.55:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
Apr 25 09:57:59 odin sshguard[487]: Blocking 221.120.224.179:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
Apr 25 21:25:30 odin sshguard[487]: Blocking 1.93.29.79:4 for >630secs: 40 danger in 4 attacks over 639 seconds (all: 40d in 1 abuses over 639s).
Apr 25 21:38:45 odin sshguard[487]: Blocking 1.93.29.79:4 for >945secs: 40 danger in 4 attacks over 10 seconds (all: 80d in 2 abuses over 1434s).
Apr 26 01:25:27 odin sshguard[487]: Blocking 1.93.33.226:4 for >630secs: 40 danger in 4 attacks over 59 seconds (all: 40d in 1 abuses over 59s).
Apr 26 01:38:28 odin sshguard[487]: Blocking 1.93.33.226:4 for >945secs: 40 danger in 4 attacks over 13 seconds (all: 80d in 2 abuses over 840s).
Apr 26 01:56:32 odin sshguard[487]: Offender '1.93.33.226:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
Apr 26 01:56:32 odin sshguard[487]: Blocking 1.93.33.226:4 for >0secs: 40 danger in 4 attacks over 13 seconds (all: 120d in 3 abuses over 1924s).
Apr 26 04:58:27 odin sshguard[487]: Blocking 186.47.45.99:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
Apr 26 08:47:25 odin sshguard[487]: Got exit signal, flushing blocked addresses and exiting...
Apr 26 08:47:25 odin sshguard[487]: Got CONTINUE signal, resuming activity.
-- Reboot --
Apr 26 17:33:01 odin sshguard[476]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
-- Reboot --
Apr 26 18:56:48 odin sshguard[480]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
-- Reboot --
Apr 26 23:15:26 odin sshguard[477]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
-- Reboot --
Apr 27 21:18:33 odin sshguard[504]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
Apr 27 21:43:46 odin sshguard[504]: Blocking 61.174.50.224:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
Apr 28 07:25:48 odin sshguard[504]: Blocking 82.165.147.213:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
Apr 28 09:47:18 odin sshguard[504]: Blocking 116.10.191.186:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
Apr 28 11:52:42 odin sshguard[504]: Blocking 61.174.51.199:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
Apr 28 12:05:05 odin sshguard[504]: Blocking 61.174.51.197:4 for >630secs: 40 danger in 4 attacks over 21 seconds (all: 40d in 1 abuses over 21s).
Apr 28 13:24:04 odin sshguard[504]: Blocking 116.10.191.217:4 for >630secs: 40 danger in 4 attacks over 47 seconds (all: 40d in 1 abuses over 47s).
Apr 28 15:23:19 odin sshguard[504]: Blocking 61.174.51.196:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
Apr 28 18:45:22 odin sshguard[504]: Blocking 116.10.191.230:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
Apr 28 19:56:36 odin sshguard[504]: Blocking 61.174.51.208:4 for >630secs: 40 danger in 4 attacks over 16 seconds (all: 40d in 1 abuses over 16s).
Apr 28 20:34:43 odin sshguard[504]: Blocking 61.174.51.223:4 for >630secs: 40 danger in 4 attacks over 3 seconds (all: 40d in 1 abuses over 3s).
Apr 29 00:55:14 odin sshguard[504]: Blocking 210.51.38.180:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
Apr 29 03:21:29 odin sshguard[504]: Blocking 116.10.191.194:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
Apr 29 06:59:33 odin sshguard[504]: Blocking 61.174.51.219:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
Apr 29 07:59:46 odin sshguard[504]: Blocking 116.10.191.228:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
Apr 29 11:07:56 odin sshguard[504]: Blocking 116.10.191.233:4 for >630secs: 40 danger in 4 attacks over 47 seconds (all: 40d in 1 abuses over 47s).
Apr 29 11:53:08 odin sshguard[504]: Blocking 61.174.51.224:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
Apr 29 12:24:01 odin sshguard[504]: Blocking 116.10.191.196:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
Apr 29 14:39:06 odin sshguard[504]: Blocking 61.174.51.225:4 for >630secs: 40 danger in 4 attacks over 34 seconds (all: 40d in 1 abuses over 34s).
Apr 29 17:11:59 odin sshguard[504]: Blocking 61.174.51.217:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
Apr 29 17:46:49 odin sshguard[504]: Blocking 61.174.51.198:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
Apr 29 18:49:40 odin sshguard[504]: Blocking 61.174.51.201:4 for >630secs: 40 danger in 4 attacks over 3 seconds (all: 40d in 1 abuses over 3s).
Apr 29 18:50:43 odin sshguard[504]: Blocking 61.174.51.226:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
Apr 29 20:44:19 odin sshguard[504]: Blocking 61.174.51.233:4 for >630secs: 40 danger in 4 attacks over 19 seconds (all: 40d in 1 abuses over 19s).
Apr 29 20:51:53 odin sshguard[504]: Blocking 61.174.51.228:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
Apr 29 22:22:36 odin sshguard[504]: Blocking 61.174.51.227:4 for >630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses over 9s).
Apr 30 01:13:33 odin sshguard[504]: Blocking 116.10.191.171:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
Apr 30 01:40:13 odin sshguard[504]: Blocking 116.10.191.224:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
Apr 30 11:54:11 odin sshguard[504]: Blocking 58.83.146.252:4 for >630secs: 40 danger in 4 attacks over 16 seconds (all: 40d in 1 abuses over 16s).
Apr 30 12:11:08 odin sshguard[504]: Blocking 83.244.203.54:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
Apr 30 13:28:05 odin sshguard[504]: Blocking 69.241.33.134:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
-- Reboot --
Apr 30 18:45:15 odin sshguard[481]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
Apr 30 19:33:25 odin sshguard[481]: Blocking 123.125.34.102:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
May 01 00:06:24 odin sshguard[481]: Blocking 117.21.191.208:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 01 04:02:11 odin sshguard[481]: Blocking 61.174.51.234:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 01 05:47:42 odin sshguard[481]: Blocking 61.174.51.205:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 01 07:59:35 odin sshguard[481]: Blocking 193.107.16.206:4 for >630secs: 40 danger in 4 attacks over 567 seconds (all: 40d in 1 abuses over 567s).
May 01 09:50:18 odin sshguard[481]: Blocking 116.10.191.204:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 01 12:16:55 odin sshguard[481]: Blocking 61.174.51.208:4 for >630secs: 40 danger in 4 attacks over 56 seconds (all: 40d in 1 abuses over 56s).
May 01 12:17:22 odin sshguard[481]: Blocking 221.120.224.180:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
May 01 14:05:05 odin sshguard[481]: Blocking 116.10.191.200:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 01 15:19:17 odin sshguard[481]: Blocking 61.174.51.235:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 01 15:58:37 odin sshguard[481]: Blocking 64.251.27.179:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 01 20:21:48 odin sshguard[481]: Blocking 42.62.17.250:4 for >630secs: 40 danger in 4 attacks over 97 seconds (all: 40d in 1 abuses over 97s).
May 02 01:14:38 odin sshguard[481]: Blocking 61.174.51.234:4 for >945secs: 40 danger in 4 attacks over 5 seconds (all: 80d in 2 abuses over 76353s).
May 02 04:36:50 odin sshguard[481]: Blocking 116.10.191.188:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 02 06:19:32 odin sshguard[481]: Blocking 116.10.191.229:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 02 06:57:35 odin sshguard[481]: Blocking 116.10.191.171:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 02 10:14:25 odin sshguard[481]: Offender '61.174.51.234:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 02 10:14:25 odin sshguard[481]: Blocking 61.174.51.234:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 108740s).
May 02 11:14:54 odin sshguard[481]: Blocking 116.10.191.200:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 76197s).
May 02 12:29:15 odin sshguard[481]: Blocking 116.10.191.204:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 95945s).
May 02 16:33:03 odin sshguard[481]: Blocking 116.10.191.236:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 02 17:16:51 odin sshguard[481]: Blocking 211.152.34.53:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
May 02 19:18:03 odin sshguard[481]: Blocking 222.242.105.93:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
May 02 19:25:38 odin sshguard[481]: Blocking 61.174.51.208:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 112179s).
May 02 20:43:09 odin sshguard[481]: Blocking 116.10.191.232:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 02 20:44:01 odin sshguard[481]: Blocking 116.10.191.181:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 03 00:34:46 odin sshguard[481]: Blocking 116.10.191.162:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 03 05:03:49 odin sshguard[481]: Blocking 115.93.7.5:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 03 05:05:15 odin sshguard[481]: Offender '116.10.191.204:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 03 05:05:15 odin sshguard[481]: Blocking 116.10.191.204:4 for >0secs: 40 danger in 4 attacks over 18 seconds (all: 120d in 3 abuses over 155705s).
May 03 06:21:48 odin sshguard[481]: Blocking 116.10.191.178:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 03 06:25:53 odin sshguard[481]: Blocking 116.10.191.206:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 03 09:03:25 odin sshguard[481]: Offender '61.174.51.208:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 03 09:03:25 odin sshguard[481]: Blocking 61.174.51.208:4 for >0secs: 40 danger in 4 attacks over 8 seconds (all: 120d in 3 abuses over 161246s).
-- Reboot --
May 03 09:21:46 odin sshguard[498]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
May 03 10:28:26 odin sshguard[498]: Blocking 116.10.191.200:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 03 13:35:24 odin sshguard[498]: Blocking 61.174.51.205:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 03 13:38:58 odin sshguard[498]: Blocking 69.64.39.114:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 03 14:17:18 odin sshguard[498]: Blocking 173.193.210.172:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
May 03 16:08:17 odin sshguard[498]: Blocking 173.193.210.172:4 for >945secs: 40 danger in 4 attacks over 17 seconds (all: 80d in 2 abuses over 6671s).
May 03 17:36:29 odin sshguard[498]: Blocking 116.10.191.216:4 for >630secs: 40 danger in 4 attacks over 17 seconds (all: 40d in 1 abuses over 17s).
May 03 19:04:54 odin sshguard[498]: Blocking 58.215.56.110:4 for >630secs: 40 danger in 4 attacks over 22 seconds (all: 40d in 1 abuses over 22s).
May 03 20:53:23 odin sshguard[498]: Blocking 116.10.191.232:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 03 21:50:38 odin sshguard[498]: Offender '173.193.210.172:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 03 21:50:38 odin sshguard[498]: Blocking 173.193.210.172:4 for >0secs: 40 danger in 4 attacks over 12 seconds (all: 120d in 3 abuses over 27212s).
May 04 00:33:37 odin sshguard[498]: Blocking 61.19.246.190:4 for >630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses over 9s).
May 04 01:21:38 odin sshguard[498]: Blocking 144.0.0.25:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 04 01:50:38 odin sshguard[498]: Blocking 116.10.191.171:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 04 04:23:09 odin sshguard[498]: Blocking 203.142.24.127:4 for >630secs: 40 danger in 4 attacks over 86 seconds (all: 40d in 1 abuses over 86s).
May 04 05:12:57 odin sshguard[498]: Blocking 116.10.191.229:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 04 06:04:24 odin sshguard[498]: Blocking 61.19.247.185:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
May 04 12:17:20 odin sshguard[498]: Blocking 221.224.18.3:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 04 12:17:44 odin sshguard[498]: Blocking 211.167.240.242:4 for >630secs: 40 danger in 4 attacks over 98 seconds (all: 40d in 1 abuses over 98s).
May 04 20:19:05 odin sshguard[498]: Blocking 116.10.191.169:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 05 01:46:54 odin sshguard[498]: Blocking 117.21.191.208:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 05 03:08:01 odin sshguard[498]: Blocking 116.10.191.213:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 05 03:33:55 odin sshguard[498]: Blocking 116.10.191.164:4 for >630secs: 40 danger in 4 attacks over 73 seconds (all: 40d in 1 abuses over 73s).
May 05 09:57:18 odin sshguard[498]: Blocking 61.174.49.116:4 for >630secs: 40 danger in 4 attacks over 3 seconds (all: 40d in 1 abuses over 3s).
May 05 10:03:37 odin sshguard[498]: Blocking 219.232.160.234:4 for >630secs: 40 danger in 4 attacks over 13 seconds (all: 40d in 1 abuses over 13s).
May 05 13:46:47 odin sshguard[498]: Blocking 116.10.191.188:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 06 02:31:04 odin sshguard[498]: Blocking 58.215.172.27:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 06 02:58:42 odin sshguard[498]: Blocking 61.174.51.205:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 221005s).
May 06 03:36:30 odin sshguard[498]: Blocking 116.10.191.229:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 167021s).
May 06 04:46:46 odin sshguard[498]: Blocking 61.160.215.119:4 for >630secs: 40 danger in 4 attacks over 13 seconds (all: 40d in 1 abuses over 13s).
May 06 06:53:05 odin sshguard[498]: Blocking 116.10.191.188:4 for >945secs: 40 danger in 4 attacks over 8 seconds (all: 80d in 2 abuses over 61584s).
May 06 08:36:16 odin sshguard[498]: Blocking 23.234.199.218:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 06 13:47:38 odin sshguard[498]: Offender '116.10.191.188:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 06 13:47:38 odin sshguard[498]: Blocking 116.10.191.188:4 for >0secs: 40 danger in 4 attacks over 91 seconds (all: 120d in 3 abuses over 86457s).
May 06 15:31:07 odin sshguard[498]: Blocking 116.10.191.169:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 155527s).
May 06 20:57:52 odin sshguard[498]: Blocking 61.174.51.235:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 06 22:53:36 odin sshguard[498]: Blocking 95.211.128.34:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 07 00:19:42 odin sshguard[498]: Blocking 222.186.40.170:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 07 00:24:46 odin sshguard[498]: Blocking 117.21.191.210:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 07 00:31:19 odin sshguard[498]: Blocking 220.177.198.40:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 07 00:32:23 odin sshguard[498]: Blocking 220.177.198.26:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 07 00:44:15 odin sshguard[498]: Blocking 117.21.191.209:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 07 00:46:14 odin sshguard[498]: Blocking 115.239.248.122:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 07 00:55:20 odin sshguard[498]: Blocking 115.239.248.50:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 07 00:59:04 odin sshguard[498]: Blocking 115.239.248.51:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 07 01:38:52 odin sshguard[498]: Blocking 222.186.40.170:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 4757s).
May 07 02:05:04 odin sshguard[498]: Blocking 222.186.34.36:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 07 04:05:23 odin sshguard[498]: Blocking 222.186.40.251:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 07 04:57:55 odin sshguard[498]: Blocking 116.10.191.164:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 177913s).
May 07 12:07:45 odin sshguard[498]: Blocking 220.177.198.33:4 for >630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
May 07 13:40:57 odin sshguard[498]: Blocking 116.10.191.165:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 07 14:23:07 odin sshguard[498]: Blocking 116.10.191.216:4 for >945secs: 40 danger in 4 attacks over 9 seconds (all: 80d in 2 abuses over 334015s).
May 07 14:25:04 odin sshguard[498]: Blocking 116.10.191.200:4 for >945secs: 40 danger in 4 attacks over 8 seconds (all: 80d in 2 abuses over 359808s).
May 07 14:32:56 odin sshguard[498]: Blocking 116.10.191.219:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 08 00:08:48 odin sshguard[498]: Blocking 116.10.191.178:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 08 00:28:30 odin sshguard[498]: Blocking 117.21.191.197:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 08 01:01:03 odin sshguard[498]: Blocking 116.10.191.201:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 08 01:30:58 odin sshguard[498]: Blocking 116.10.191.218:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 08 01:39:28 odin sshguard[498]: Blocking 27.118.20.29:4 for >630secs: 40 danger in 4 attacks over 81 seconds (all: 40d in 1 abuses over 81s).
May 08 02:08:54 odin sshguard[498]: Blocking 116.10.191.184:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 08 04:06:53 odin sshguard[498]: Blocking 61.174.50.224:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 08 04:08:53 odin sshguard[498]: Blocking 116.10.191.225:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 08 08:22:49 odin sshguard[498]: Blocking 61.174.51.235:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 127504s).
May 08 10:17:16 odin sshguard[498]: Blocking 116.10.191.234:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 08 10:33:12 odin sshguard[498]: Blocking 116.10.191.215:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 08 11:39:43 odin sshguard[498]: Blocking 116.10.191.170:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 08 14:29:53 odin sshguard[498]: Offender '116.10.191.216:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 08 14:29:53 odin sshguard[498]: Blocking 116.10.191.216:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 420821s).
May 08 14:41:02 odin sshguard[498]: Blocking 61.174.51.232:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 08 14:54:41 odin sshguard[498]: Blocking 220.177.198.31:4 for >630secs: 40 danger in 4 attacks over 16 seconds (all: 40d in 1 abuses over 16s).
May 08 15:06:05 odin sshguard[498]: Blocking 61.174.51.233:4 for >630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses over 9s).
May 08 15:40:54 odin sshguard[498]: Blocking 116.10.191.195:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 08 16:17:37 odin sshguard[498]: Blocking 195.168.21.102:4 for >630secs: 40 danger in 4 attacks over 13 seconds (all: 40d in 1 abuses over 13s).
May 08 17:52:08 odin sshguard[498]: Blocking 116.10.191.227:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 08 18:25:45 odin sshguard[498]: Blocking 116.10.191.210:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 08 21:21:57 odin sshguard[498]: Blocking 116.10.191.219:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 110947s).
May 08 23:09:11 odin sshguard[498]: Blocking 113.108.211.131:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 08 23:57:40 odin sshguard[498]: Blocking 116.10.191.234:4 for >945secs: 40 danger in 4 attacks over 11 seconds (all: 80d in 2 abuses over 49232s).
May 09 00:18:53 odin sshguard[498]: Blocking 116.10.191.233:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 09 01:18:23 odin sshguard[498]: Offender '116.10.191.234:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 09 01:18:23 odin sshguard[498]: Blocking 116.10.191.234:4 for >0secs: 40 danger in 4 attacks over 8 seconds (all: 120d in 3 abuses over 54075s).
May 09 03:18:13 odin sshguard[498]: Blocking 116.10.191.201:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 94637s).
May 09 06:37:54 odin sshguard[498]: Blocking 116.10.191.222:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 09 08:01:57 odin sshguard[498]: Blocking 112.206.228.98:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 09 08:59:33 odin sshguard[498]: Blocking 61.174.51.231:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 09 13:57:08 odin sshguard[498]: Blocking 116.10.191.215:4 for >945secs: 40 danger in 4 attacks over 8 seconds (all: 80d in 2 abuses over 98644s).
May 09 13:58:06 odin sshguard[498]: Blocking 116.10.191.227:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 72364s).
May 09 14:02:31 odin sshguard[498]: Offender '116.10.191.201:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 09 14:02:31 odin sshguard[498]: Blocking 116.10.191.201:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 133295s).
May 09 14:21:00 odin sshguard[498]: Blocking 116.10.191.195:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 81613s).
May 09 17:32:32 odin sshguard[498]: Blocking 103.9.91.6:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 09 17:47:37 odin sshguard[498]: Blocking 116.10.191.222:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 40191s).
May 09 17:53:37 odin sshguard[498]: Blocking 5.79.6.226:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 09 19:20:58 odin sshguard[498]: Blocking 199.195.215.184:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 09 19:28:51 odin sshguard[498]: Offender '61.174.51.235:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 09 19:28:51 odin sshguard[498]: Blocking 61.174.51.235:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 253866s).
May 09 19:29:06 odin sshguard[498]: Blocking 116.10.191.228:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 09 19:57:30 odin sshguard[498]: Blocking 61.174.51.231:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 39485s).
May 09 20:00:55 odin sshguard[498]: Blocking 116.10.191.231:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 09 23:27:41 odin sshguard[498]: Offender '116.10.191.219:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 09 23:27:41 odin sshguard[498]: Blocking 116.10.191.219:4 for >0secs: 40 danger in 4 attacks over 4 seconds (all: 120d in 3 abuses over 204891s).
May 09 23:52:05 odin sshguard[498]: Blocking 116.10.191.202:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 10 01:15:04 odin sshguard[498]: Blocking 116.10.191.225:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 162377s).
May 10 01:17:47 odin sshguard[498]: Blocking 162.13.185.136:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 10 01:51:19 odin sshguard[498]: Blocking 220.177.198.31:4 for >945secs: 40 danger in 4 attacks over 12 seconds (all: 80d in 2 abuses over 125814s).
May 10 03:08:12 odin sshguard[498]: Blocking 117.21.191.197:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 182389s).
May 10 03:45:24 odin sshguard[498]: Blocking 116.10.191.196:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 10 23:19:32 odin sshguard[498]: Blocking 116.10.191.231:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 98323s).
May 10 23:39:08 odin sshguard[498]: Blocking 116.10.191.214:4 for >630secs: 40 danger in 4 attacks over 2 seconds (all: 40d in 1 abuses over 2s).
May 11 00:07:31 odin sshguard[498]: Blocking 116.10.191.237:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 11 00:39:46 odin sshguard[498]: Offender '116.10.191.225:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 11 00:39:46 odin sshguard[498]: Blocking 116.10.191.225:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 246659s).
May 11 02:22:54 odin sshguard[498]: Blocking 83.244.203.54:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 11 04:02:24 odin sshguard[498]: Blocking 61.174.50.224:4 for >945secs: 40 danger in 4 attacks over 9 seconds (all: 80d in 2 abuses over 258937s).
May 11 04:36:40 odin sshguard[498]: Offender '116.10.191.229:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 11 04:36:40 odin sshguard[498]: Blocking 116.10.191.229:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 602631s).
May 11 07:07:28 odin sshguard[498]: Blocking 116.10.191.235:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
-- Reboot --
May 11 07:29:42 odin sshguard[495]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
May 11 10:41:22 odin sshguard[495]: Blocking 116.10.191.211:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 11 11:52:30 odin sshguard[495]: Blocking 116.10.191.194:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 11 12:02:52 odin sshguard[495]: Blocking 80.82.64.197:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
May 11 13:02:59 odin sshguard[495]: Blocking 61.174.51.232:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 11 14:07:19 odin sshguard[495]: Blocking 191.236.83.101:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 11 14:52:20 odin sshguard[495]: Blocking 116.10.191.224:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 11 16:00:07 odin sshguard[495]: Blocking 61.174.51.233:4 for >630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
May 11 16:45:21 odin sshguard[495]: Blocking 116.10.191.205:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 11 19:25:40 odin sshguard[495]: Blocking 116.10.191.199:4 for >630secs: 40 danger in 4 attacks over 31 seconds (all: 40d in 1 abuses over 31s).
May 11 21:22:52 odin sshguard[495]: Blocking 61.174.50.184:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 12 00:53:42 odin sshguard[495]: Blocking 61.174.51.219:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 12 04:56:16 odin sshguard[495]: Blocking 107.170.139.201:4 for >630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses over 9s).
May 12 05:39:03 odin sshguard[495]: Blocking 61.174.51.217:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 12 05:58:35 odin sshguard[495]: Blocking 116.10.191.228:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 12 06:35:03 odin sshguard[495]: Blocking 74.63.241.146:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 12 09:50:48 odin sshguard[495]: Blocking 213.240.236.91:4 for >630secs: 40 danger in 4 attacks over 29 seconds (all: 40d in 1 abuses over 29s).
May 12 10:37:47 odin sshguard[495]: Blocking 113.162.158.244:4 for >630secs: 40 danger in 4 attacks over 3 seconds (all: 40d in 1 abuses over 3s).
May 12 11:30:36 odin sshguard[495]: Blocking 113.162.158.244:4 for >945secs: 40 danger in 4 attacks over 4 seconds (all: 80d in 2 abuses over 3172s).
May 12 14:07:24 odin sshguard[495]: Blocking 116.10.191.223:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 12 14:39:57 odin sshguard[495]: Blocking 74.63.241.146:4 for >945secs: 40 danger in 4 attacks over 8 seconds (all: 80d in 2 abuses over 29102s).
May 12 15:45:29 odin sshguard[495]: Blocking 217.8.84.24:4 for >630secs: 40 danger in 4 attacks over 28 seconds (all: 40d in 1 abuses over 28s).
May 12 16:31:46 odin sshguard[495]: Offender '74.63.241.146:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 12 16:31:46 odin sshguard[495]: Blocking 74.63.241.146:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 35811s).
May 12 17:03:59 odin sshguard[495]: Blocking 162.253.66.74:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 12 17:52:15 odin sshguard[495]: Blocking 116.10.191.181:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 12 18:36:36 odin sshguard[495]: Blocking 217.109.96.243:4 for >630secs: 40 danger in 4 attacks over 26 seconds (all: 40d in 1 abuses over 26s).
May 12 20:27:50 odin sshguard[495]: Blocking 116.10.191.211:4 for >945secs: 40 danger in 4 attacks over 12 seconds (all: 80d in 2 abuses over 121596s).
May 12 21:26:38 odin sshguard[495]: Blocking 61.174.51.220:4 for >630secs: 40 danger in 4 attacks over 2 seconds (all: 40d in 1 abuses over 2s).
May 12 21:54:12 odin sshguard[495]: Blocking 116.10.191.170:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 12 21:58:33 odin sshguard[495]: Got CONTINUE signal, resuming activity.
May 12 21:58:33 odin sshguard[495]: Got exit signal, flushing blocked addresses and exiting...
-- Reboot --
May 12 21:59:23 odin sshguard[489]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
May 12 22:39:43 odin sshguard[489]: Blocking 211.238.146.134:4 for >630secs: 40 danger in 4 attacks over 28 seconds (all: 40d in 1 abuses over 28s).
May 12 23:43:44 odin sshguard[489]: Blocking 116.10.191.237:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 13 01:19:55 odin sshguard[489]: Blocking 208.115.103.104:4 for >630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses over 9s).
May 13 03:34:17 odin sshguard[489]: Blocking 61.174.51.213:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 13 04:37:48 odin sshguard[489]: Blocking 61.174.51.217:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
May 13 05:42:43 odin sshguard[489]: Blocking 116.10.191.213:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 13 06:22:04 odin sshguard[489]: Blocking 116.10.191.224:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 13 10:07:44 odin sshguard[489]: Blocking 116.10.191.217:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 13 11:03:08 odin sshguard[489]: Blocking 61.174.51.233:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 13 12:24:16 odin sshguard[489]: Blocking 168.61.42.179:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 13 12:47:42 odin sshguard[489]: Blocking 61.174.51.212:4 for >630secs: 40 danger in 4 attacks over 15 seconds (all: 40d in 1 abuses over 15s).
May 13 14:40:35 odin sshguard[489]: Blocking 191.239.10.53:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
May 13 16:41:25 odin sshguard[489]: Blocking 116.10.191.230:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 13 18:55:42 odin sshguard[489]: Blocking 116.10.191.210:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 13 19:01:24 odin sshguard[489]: Blocking 116.10.191.203:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 13 20:16:24 odin sshguard[489]: Blocking 199.195.215.182:4 for >630secs: 40 danger in 4 attacks over 13 seconds (all: 40d in 1 abuses over 13s).
May 13 21:10:38 odin sshguard[489]: Blocking 116.10.191.237:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 77221s).
May 13 21:12:55 odin sshguard[489]: Blocking 61.174.49.126:4 for >630secs: 40 danger in 4 attacks over 2 seconds (all: 40d in 1 abuses over 2s).
May 13 21:12:57 odin sshguard[489]: Blocking 144.0.0.48:4 for >630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
May 13 21:12:57 odin sshguard[489]: Blocking 61.153.105.105:4 for >630secs: 40 danger in 4 attacks over 3 seconds (all: 40d in 1 abuses over 3s).
May 13 21:12:58 odin sshguard[489]: Blocking 144.0.0.53:4 for >630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
May 13 21:26:40 odin sshguard[489]: Blocking 61.174.51.220:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 13 21:44:20 odin sshguard[489]: Blocking 198.74.103.2:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 14 00:51:11 odin sshguard[489]: Blocking 61.174.51.219:4 for >630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
May 14 01:23:41 odin sshguard[489]: Blocking 116.10.191.236:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 14 02:48:16 odin sshguard[489]: Blocking 116.10.191.212:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 14 03:37:43 odin sshguard[489]: Blocking 222.186.42.57:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 14 03:41:24 odin sshguard[489]: Blocking 116.10.191.183:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 14 03:47:40 odin sshguard[489]: Blocking 116.10.191.221:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 14 04:50:03 odin sshguard[489]: Blocking 61.174.51.217:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 87147s).
May 14 05:38:41 odin sshguard[489]: Blocking 61.129.33.35:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 14 07:12:35 odin sshguard[489]: Blocking 116.10.191.194:4 for >630secs: 40 danger in 4 attacks over 15 seconds (all: 40d in 1 abuses over 15s).
May 14 07:52:38 odin sshguard[489]: Blocking 116.10.191.174:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 14 08:15:21 odin sshguard[489]: Blocking 116.10.191.238:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 14 08:38:29 odin sshguard[489]: Blocking 116.10.191.168:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 14 08:40:00 odin sshguard[489]: Blocking 117.79.91.234:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
May 14 09:16:02 odin sshguard[489]: Blocking 116.10.191.172:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 14 12:29:37 odin sshguard[489]: Blocking 198.74.103.2:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 53124s).
May 14 12:55:29 odin sshguard[489]: Blocking 116.10.191.217:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 96472s).
May 14 16:10:39 odin sshguard[489]: Blocking 116.10.191.200:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 14 16:29:17 odin sshguard[489]: Blocking 116.10.191.180:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 14 17:17:54 odin sshguard[489]: Blocking 116.10.191.220:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 14 17:23:02 odin sshguard[489]: Blocking 61.174.51.213:4 for >945secs: 40 danger in 4 attacks over 11 seconds (all: 80d in 2 abuses over 136133s).
May 14 18:05:30 odin sshguard[489]: Blocking 116.10.191.224:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 128614s).
May 14 18:49:13 odin sshguard[489]: Blocking 61.174.51.212:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 108106s).
May 14 22:10:49 odin sshguard[489]: Blocking 116.10.191.171:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 14 22:44:29 odin sshguard[489]: Blocking 116.10.191.203:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 99792s).
May 15 01:07:05 odin sshguard[489]: Blocking 116.10.191.233:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 15 01:48:43 odin sshguard[489]: Blocking 116.10.191.187:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 15 04:22:49 odin sshguard[489]: Offender '198.74.103.2:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 15 04:22:49 odin sshguard[489]: Blocking 198.74.103.2:4 for >0secs: 40 danger in 4 attacks over 9 seconds (all: 120d in 3 abuses over 110316s).
May 15 05:21:17 odin sshguard[489]: Blocking 221.224.18.3:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 15 05:33:35 odin sshguard[489]: Blocking 1.224.163.16:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 15 08:02:01 odin sshguard[489]: Blocking 116.10.191.187:4 for >945secs: 40 danger in 4 attacks over 9 seconds (all: 80d in 2 abuses over 22405s).
May 15 09:39:50 odin sshguard[489]: Blocking 61.174.51.230:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 15 11:15:35 odin sshguard[489]: Blocking 61.174.51.219:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 123868s).
May 15 11:17:56 odin sshguard[489]: Offender '116.10.191.187:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 15 11:17:56 odin sshguard[489]: Blocking 116.10.191.187:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 34160s).
May 15 13:45:27 odin sshguard[489]: Blocking 116.10.191.168:4 for >945secs: 40 danger in 4 attacks over 8 seconds (all: 80d in 2 abuses over 104825s).
May 15 14:44:07 odin sshguard[489]: Blocking 116.10.191.166:4 for >630secs: 40 danger in 4 attacks over 17 seconds (all: 40d in 1 abuses over 17s).
May 15 15:33:45 odin sshguard[489]: Blocking 116.10.191.238:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 112711s).
May 15 16:19:51 odin sshguard[489]: Blocking 116.10.191.228:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 15 18:19:47 odin sshguard[489]: Blocking 116.10.191.180:4 for >945secs: 40 danger in 4 attacks over 8 seconds (all: 80d in 2 abuses over 93036s).
-- Reboot --
May 15 18:24:06 odin sshguard[490]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
May 15 21:38:55 odin sshguard[490]: Blocking 116.10.191.167:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 15 22:28:22 odin sshguard[490]: Blocking 116.10.191.220:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 15 22:50:37 odin sshguard[490]: Blocking 210.66.119.89:4 for >630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
May 16 00:03:50 odin sshguard[490]: Blocking 116.10.191.203:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 16 03:42:08 odin sshguard[490]: Blocking 92.38.233.191:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 16 04:42:41 odin sshguard[490]: Blocking 116.10.191.237:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 16 05:47:07 odin sshguard[490]: Blocking 116.10.191.238:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 16 07:38:33 odin sshguard[490]: Blocking 116.10.191.170:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 16 08:47:19 odin sshguard[490]: Blocking 116.10.191.172:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 16 11:30:59 odin sshguard[490]: Blocking 61.174.51.217:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
May 16 12:54:56 odin sshguard[490]: Blocking 186.67.83.58:4 for >630secs: 40 danger in 4 attacks over 29 seconds (all: 40d in 1 abuses over 29s).
May 16 12:56:12 odin sshguard[490]: Blocking 211.238.146.134:4 for >630secs: 40 danger in 4 attacks over 28 seconds (all: 40d in 1 abuses over 28s).
May 16 13:21:42 odin sshguard[490]: Blocking 62.210.181.148:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 16 14:01:04 odin sshguard[490]: Blocking 116.10.191.237:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 33509s).
May 16 15:27:28 odin sshguard[490]: Blocking 116.10.191.182:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 16 16:32:07 odin sshguard[490]: Blocking 144.0.0.21:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 16 17:14:45 odin sshguard[490]: Blocking 116.10.191.168:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 16 19:17:21 odin sshguard[490]: Blocking 58.240.17.250:4 for >630secs: 40 danger in 4 attacks over 14 seconds (all: 40d in 1 abuses over 14s).
May 16 19:30:24 odin sshguard[490]: Blocking 61.174.51.213:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 16 20:21:05 odin sshguard[490]: Blocking 116.10.191.217:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 16 20:49:31 odin sshguard[490]: Blocking 117.21.191.197:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 16 21:03:26 odin sshguard[490]: Blocking 116.10.191.190:4 for >630secs: 40 danger in 4 attacks over 47 seconds (all: 40d in 1 abuses over 47s).
May 16 21:26:46 odin sshguard[490]: Blocking 61.174.51.220:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 16 23:34:40 odin sshguard[490]: Blocking 116.10.191.186:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 17 00:50:37 odin sshguard[490]: Blocking 116.10.191.232:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 17 03:42:07 odin sshguard[490]: Blocking 61.174.51.213:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 29508s).
May 17 04:56:45 odin sshguard[490]: Blocking 116.10.191.168:4 for >945secs: 40 danger in 4 attacks over 10 seconds (all: 80d in 2 abuses over 42127s).
May 17 05:14:59 odin sshguard[490]: Offender '116.10.191.237:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 17 05:14:59 odin sshguard[490]: Blocking 116.10.191.237:4 for >0secs: 40 danger in 4 attacks over 9 seconds (all: 120d in 3 abuses over 88344s).
May 17 07:07:07 odin sshguard[490]: Blocking 116.10.191.228:4 for >630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses over 9s).
May 17 10:05:44 odin sshguard[490]: Blocking 173.192.91.218:4 for >630secs: 40 danger in 4 attacks over 15 seconds (all: 40d in 1 abuses over 15s).
May 17 10:36:25 odin sshguard[490]: Blocking 116.10.191.171:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 17 12:29:05 odin sshguard[490]: Blocking 37.187.92.137:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 17 12:31:37 odin sshguard[490]: Blocking 116.10.191.166:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 17 12:53:42 odin sshguard[490]: Blocking 116.10.191.167:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 141293s).
May 17 13:14:37 odin sshguard[490]: Blocking 61.174.51.212:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 17 16:18:51 odin sshguard[490]: Blocking 116.10.191.202:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 17 16:40:36 odin sshguard[490]: Blocking 116.10.191.182:4 for >945secs: 40 danger in 4 attacks over 11 seconds (all: 80d in 2 abuses over 90794s).
May 17 18:01:26 odin sshguard[490]: Blocking 116.10.191.223:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 17 18:35:11 odin sshguard[490]: Blocking 116.10.191.239:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 17 18:44:13 odin sshguard[490]: Offender '116.10.191.168:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 17 18:44:13 odin sshguard[490]: Blocking 116.10.191.168:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 91775s).
May 17 21:13:38 odin sshguard[490]: Blocking 116.10.191.194:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 17 21:49:32 odin sshguard[490]: Blocking 116.10.191.180:4 for >630secs: 40 danger in 4 attacks over 22 seconds (all: 40d in 1 abuses over 22s).
May 17 22:03:24 odin sshguard[490]: Blocking 116.10.191.172:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 134173s).
May 18 01:20:30 odin sshguard[490]: Blocking 111.74.134.216:4 for >630secs: 40 danger in 4 attacks over 18 seconds (all: 40d in 1 abuses over 18s).
May 18 01:24:30 odin sshguard[490]: Blocking 116.10.191.217:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 104612s).
May 18 01:31:33 odin sshguard[490]: Blocking 116.10.191.197:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 18 01:31:51 odin sshguard[490]: Blocking 111.74.134.216:4 for >945secs: 40 danger in 4 attacks over 17 seconds (all: 80d in 2 abuses over 699s).
May 18 03:39:30 odin sshguard[490]: Offender '61.174.51.213:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 18 03:39:30 odin sshguard[490]: Blocking 61.174.51.213:4 for >0secs: 40 danger in 4 attacks over 4 seconds (all: 120d in 3 abuses over 115751s).
May 18 06:50:15 odin sshguard[490]: Blocking 59.18.105.197:4 for >630secs: 40 danger in 4 attacks over 19 seconds (all: 40d in 1 abuses over 19s).
May 18 08:29:55 odin sshguard[490]: Blocking 1.234.41.51:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 18 10:57:26 odin sshguard[490]: Offender '116.10.191.172:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 18 10:57:26 odin sshguard[490]: Blocking 116.10.191.172:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 180615s).
May 18 13:48:21 odin sshguard[490]: Blocking 98.143.175.79:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 18 14:19:45 odin sshguard[490]: Offender '116.10.191.217:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 18 14:19:45 odin sshguard[490]: Blocking 116.10.191.217:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 151127s).
May 18 16:00:10 odin sshguard[490]: Blocking 184.22.232.67:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 18 17:33:36 odin sshguard[490]: Blocking 91.121.5.88:4 for >630secs: 40 danger in 4 attacks over 195 seconds (all: 40d in 1 abuses over 195s).
May 18 20:40:14 odin sshguard[490]: Blocking 61.174.51.212:4 for >945secs: 40 danger in 4 attacks over 24 seconds (all: 80d in 2 abuses over 113144s).
May 18 21:50:17 odin sshguard[490]: Blocking 116.10.191.223:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 100138s).
May 18 22:19:23 odin sshguard[490]: Blocking 116.10.191.196:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 18 22:49:02 odin sshguard[490]: Blocking 219.138.135.68:4 for >630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
May 18 22:53:11 odin sshguard[490]: Blocking 144.0.0.31:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 18 23:39:54 odin sshguard[490]: Blocking 61.160.222.81:4 for >630secs: 40 danger in 4 attacks over 84 seconds (all: 40d in 1 abuses over 84s).
May 19 07:12:26 odin sshguard[490]: Blocking 222.190.114.98:4 for >630secs: 40 danger in 4 attacks over 21 seconds (all: 40d in 1 abuses over 21s).
May 19 11:03:43 odin sshguard[490]: Blocking 195.154.64.105:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 19 14:36:38 odin sshguard[490]: Blocking 116.10.191.238:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 290979s).
May 19 20:51:30 odin sshguard[490]: Offender '116.10.191.167:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 19 20:51:30 odin sshguard[490]: Blocking 116.10.191.167:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 342761s).
May 19 23:20:38 odin sshguard[490]: Blocking 116.10.191.203:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 343016s).
May 20 00:53:36 odin sshguard[490]: Blocking 116.10.191.183:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 20 03:24:07 odin sshguard[490]: Blocking 198.50.186.144:4 for >630secs: 40 danger in 4 attacks over 13 seconds (all: 40d in 1 abuses over 13s).
May 20 03:47:22 odin sshguard[490]: Blocking 61.174.51.217:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 317798s).
May 20 06:27:17 odin sshguard[490]: Blocking 116.10.191.228:4 for >945secs: 40 danger in 4 attacks over 8 seconds (all: 80d in 2 abuses over 256819s).
May 20 07:22:46 odin sshguard[490]: Offender '116.10.191.238:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 20 07:22:46 odin sshguard[490]: Blocking 116.10.191.238:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 351347s).
May 20 08:24:00 odin sshguard[490]: Blocking 116.10.191.170:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 348335s).
May 20 09:17:03 odin sshguard[490]: Blocking 116.10.191.180:4 for >945secs: 40 danger in 4 attacks over 6 seconds (all: 80d in 2 abuses over 214073s).
May 20 13:03:34 odin sshguard[490]: Blocking 61.153.105.97:4 for >630secs: 40 danger in 4 attacks over 3 seconds (all: 40d in 1 abuses over 3s).
May 20 14:34:14 odin sshguard[490]: Offender '61.174.51.212:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 20 14:34:14 odin sshguard[490]: Blocking 61.174.51.212:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 263984s).
May 20 21:48:21 odin sshguard[490]: Blocking 184.154.150.118:4 for >630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
May 20 23:42:28 odin sshguard[490]: Blocking 116.10.191.221:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 21 00:13:17 odin sshguard[490]: Blocking 61.174.51.219:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 21 00:33:46 odin sshguard[490]: Offender '116.10.191.182:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 21 00:33:46 odin sshguard[490]: Blocking 116.10.191.182:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 378384s).
May 21 04:44:37 odin sshguard[490]: Blocking 115.239.248.121:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 21 04:47:05 odin sshguard[490]: Blocking 220.177.198.40:4 for >630secs: 40 danger in 4 attacks over 15 seconds (all: 40d in 1 abuses over 15s).
May 21 04:59:18 odin sshguard[490]: Blocking 116.10.191.166:4 for >945secs: 40 danger in 4 attacks over 13 seconds (all: 80d in 2 abuses over 318468s).
May 21 05:11:10 odin sshguard[490]: Offender '61.174.51.217:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 21 05:11:10 odin sshguard[490]: Blocking 61.174.51.217:4 for >0secs: 40 danger in 4 attacks over 24 seconds (all: 120d in 3 abuses over 409226s).
May 21 06:20:30 odin sshguard[490]: Blocking 115.239.248.122:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 21 06:20:38 odin sshguard[490]: Blocking 115.239.248.53:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 21 06:21:03 odin sshguard[490]: Blocking 115.239.248.50:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 21 06:21:42 odin sshguard[490]: Blocking 220.177.198.24:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 21 06:39:00 odin sshguard[490]: Offender '116.10.191.228:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 21 06:39:00 odin sshguard[490]: Blocking 116.10.191.228:4 for >0secs: 40 danger in 4 attacks over 8 seconds (all: 120d in 3 abuses over 343922s).
May 21 06:45:56 odin sshguard[490]: Blocking 220.177.198.43:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 21 06:55:31 odin sshguard[490]: Blocking 117.21.226.103:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 21 07:01:52 odin sshguard[490]: Blocking 220.177.198.26:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 21 07:08:45 odin sshguard[490]: Blocking 115.230.126.28:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 21 07:15:52 odin sshguard[490]: Blocking 222.186.40.251:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 21 07:17:03 odin sshguard[490]: Blocking 115.239.248.61:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 21 07:37:32 odin sshguard[490]: Blocking 222.186.40.170:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 21 10:47:15 odin sshguard[490]: Blocking 61.174.51.219:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 38044s).
May 21 12:02:51 odin sshguard[490]: Blocking 116.10.191.220:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 480876s).
May 21 17:34:13 odin sshguard[490]: Blocking 116.10.191.196:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 242097s).
May 21 17:46:37 odin sshguard[490]: Blocking 116.10.191.221:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 65055s).
May 21 19:54:39 odin sshguard[490]: Blocking 60.10.203.18:4 for >630secs: 40 danger in 4 attacks over 18 seconds (all: 40d in 1 abuses over 18s).
May 21 20:28:59 odin sshguard[490]: Blocking 220.177.198.86:4 for >630secs: 40 danger in 4 attacks over 787 seconds (all: 40d in 1 abuses over 787s).
May 21 22:04:58 odin sshguard[490]: Blocking 116.10.191.190:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 435739s).
May 21 23:14:15 odin sshguard[490]: Blocking 222.186.34.208:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 21 23:44:12 odin sshguard[490]: Blocking 66.240.192.138:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 21 23:53:26 odin sshguard[490]: Offender '61.174.51.219:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 21 23:53:26 odin sshguard[490]: Blocking 61.174.51.219:4 for >0secs: 40 danger in 4 attacks over 3 seconds (all: 120d in 3 abuses over 85215s).
May 22 05:48:24 odin sshguard[490]: Offender '116.10.191.166:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 22 05:48:24 odin sshguard[490]: Blocking 116.10.191.166:4 for >0secs: 40 danger in 4 attacks over 8 seconds (all: 120d in 3 abuses over 407814s).
May 22 08:11:07 odin sshguard[490]: Offender '116.10.191.170:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 22 08:11:07 odin sshguard[490]: Blocking 116.10.191.170:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 520362s).
May 22 11:11:43 odin sshguard[490]: Blocking 222.163.192.147:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 22 11:59:06 odin sshguard[490]: Blocking 61.174.51.233:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 22 13:31:02 odin sshguard[490]: Blocking 116.10.191.174:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 22 13:53:11 odin sshguard[490]: Blocking 116.10.191.171:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 443813s).
May 22 14:56:23 odin sshguard[490]: Offender '116.10.191.203:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 22 14:56:23 odin sshguard[490]: Blocking 116.10.191.203:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 571961s).
May 22 15:48:39 odin sshguard[490]: Blocking 89.144.14.58:4 for >630secs: 40 danger in 4 attacks over 186 seconds (all: 40d in 1 abuses over 186s).
May 22 16:18:01 odin sshguard[490]: Blocking 116.10.191.218:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 22 17:35:24 odin sshguard[490]: Offender '116.10.191.223:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 22 17:35:24 odin sshguard[490]: Blocking 116.10.191.223:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 430445s).
May 22 20:01:03 odin sshguard[490]: Offender '116.10.191.196:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 22 20:01:03 odin sshguard[490]: Blocking 116.10.191.196:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 337307s).
May 22 21:11:48 odin sshguard[490]: Blocking 116.10.191.186:4 for >945secs: 40 danger in 4 attacks over 11 seconds (all: 80d in 2 abuses over 509835s).
May 22 21:34:53 odin sshguard[490]: Blocking 61.174.51.220:4 for >945secs: 40 danger in 4 attacks over 4 seconds (all: 80d in 2 abuses over 518894s).
May 23 04:28:32 odin sshguard[490]: Blocking 216.151.212.100:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 23 06:38:30 odin sshguard[490]: Blocking 27.251.89.10:4 for >630secs: 40 danger in 4 attacks over 13 seconds (all: 40d in 1 abuses over 13s).
May 23 11:31:33 odin sshguard[490]: Offender '116.10.191.171:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 23 11:31:33 odin sshguard[490]: Blocking 116.10.191.171:4 for >0secs: 40 danger in 4 attacks over 7 seconds (all: 120d in 3 abuses over 521715s).
May 23 14:11:25 odin sshguard[490]: Blocking 116.10.191.232:4 for >945secs: 40 danger in 4 attacks over 8 seconds (all: 80d in 2 abuses over 566456s).
May 23 17:40:45 odin sshguard[490]: Blocking 116.10.191.222:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
-- Reboot --
May 23 17:50:07 odin sshguard[463]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
-- Reboot --
May 23 20:37:49 odin sshguard[620]: Started successfully [(a,p,s)=(40, 420, 1200)], now ready to scan.
May 23 20:47:48 odin sshguard[620]: Blocking 116.10.191.235:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 23 23:38:32 odin sshguard[620]: Blocking 69.64.38.118:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 24 09:06:28 odin sshguard[620]: Blocking 116.10.191.222:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 24 09:55:32 odin sshguard[620]: Blocking 123.30.182.178:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
May 24 13:02:26 odin sshguard[620]: Blocking 116.10.191.183:4 for >630secs: 40 danger in 4 attacks over 8 seconds (all: 40d in 1 abuses over 8s).
May 24 14:10:54 odin sshguard[620]: Blocking 116.10.191.220:4 for >630secs: 40 danger in 4 attacks over 10 seconds (all: 40d in 1 abuses over 10s).
May 24 16:49:32 odin sshguard[620]: Blocking 116.10.191.202:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 24 20:01:12 odin sshguard[620]: Blocking 116.10.191.173:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 24 21:00:28 odin sshguard[620]: Blocking 116.10.191.194:4 for >630secs: 40 danger in 4 attacks over 5 seconds (all: 40d in 1 abuses over 5s).
May 25 00:54:12 odin sshguard[620]: Blocking 116.10.191.215:4 for >630secs: 40 danger in 4 attacks over 11 seconds (all: 40d in 1 abuses over 11s).
May 25 02:02:14 odin sshguard[620]: Blocking 116.10.191.235:4 for >945secs: 40 danger in 4 attacks over 2 seconds (all: 80d in 2 abuses over 105272s).
May 25 04:16:20 odin sshguard[620]: Blocking 122.224.11.46:4 for >630secs: 40 danger in 4 attacks over 9 seconds (all: 40d in 1 abuses over 9s).
May 26 03:38:03 odin sshguard[620]: Blocking 116.10.191.198:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 26 06:45:25 odin sshguard[620]: Blocking 116.10.191.194:4 for >945secs: 40 danger in 4 attacks over 7 seconds (all: 80d in 2 abuses over 121502s).
May 26 06:56:59 odin sshguard[620]: Offender '116.10.191.235:4' scored 120 danger in 3 abuses (threshold 120) -> blacklisted.
May 26 06:56:59 odin sshguard[620]: Blocking 116.10.191.235:4 for >0secs: 40 danger in 4 attacks over 6 seconds (all: 120d in 3 abuses over 209357s).
May 26 09:21:00 odin sshguard[620]: Blocking 61.174.51.207:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
May 26 09:59:20 odin sshguard[620]: Blocking 61.174.51.205:4 for >630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
May 26 10:53:13 odin sshguard[620]: Blocking 113.171.10.37:4 for >630secs: 40 danger in 4 attacks over 12 seconds (all: 40d in 1 abuses over 12s).
May 26 14:37:35 odin sshguard[620]: Blocking 61.174.51.230:4 for >630secs: 40 danger in 4 attacks over 6 seconds (all: 40d in 1 abuses over 6s).
May 26 16:42:39 odin sshguard[620]: Blocking 116.10.191.175:4 for >630secs: 40 danger in 4 attacks over 7 seconds (all: 40d in 1 abuses over 7s).
ewaller$@$odin /etc 1042 %

Any questions?

Kotrfa · 2014-05-27 16:19:24

Hello.

I changed port to something else and even now I can see it really helps. I also disabled direct root access, but I need to have passwords access enabled.

I'm also going to start a new thread about sshguard, although now it doesn't seem necessary.

Thank you

EDIT: Somehow I made sshguard work - I made once again all this simple things on the sshguard arch wiki guide and it works now.

Last edited by Kotrfa (2014-05-27 16:58:04)

WonderWoofy · 2014-05-27 21:11:35

Please mark your thread as [Solved] then.

supersymmetry · 2015-04-22 16:00:39

What wonderwulfy said. Luckily I had that setting on but, while setting up a new vps (with root over 'serial console' via provider backend), I did forget to turn off password authentication.

Good thing I noticed quickly enough. I don't think I'll change port 22 any time again though (it's my darn port to use anyway, not theirs to attack) but I did block out the entire offensive country (China). Tough look, maybe those guys need to have a internal discussion about how to proceed with approaching foreigners. Anyway, not like that machine is hosting a public service anyway... guess I might setup a DMZ or so to mitigate some of those attacks - or better yet, port knocking. I might consider unblocking chinese ip's. Hate to discriminate, but 99% of these attacks come from 1 country.

Arch Linux

#1 2014-05-26 18:57:55

[SOLVED]less sshd logging

#2 2014-05-26 19:16:19

Re: [SOLVED]less sshd logging

#3 2014-05-26 19:29:49

Re: [SOLVED]less sshd logging

#4 2014-05-26 22:14:51

Re: [SOLVED]less sshd logging

#5 2014-05-26 23:59:16

Re: [SOLVED]less sshd logging

#6 2014-05-27 16:19:24

Re: [SOLVED]less sshd logging

#7 2014-05-27 21:11:35

Re: [SOLVED]less sshd logging

#8 2015-04-22 16:00:39

Re: [SOLVED]less sshd logging

Board footer