Logs show failed password for invalid user root from <IP Address> port 2924 ssh2
- by Chris Hanson
I'm getting a constant flow of these messages in my logs. The port is variable (seemingly between 1024 and 65535). I can simulate it myself by running
sftp root@<my ip>
I've commented out the sftp subsystem line in my sshd_config. These ports should be closed by provider's firewall.
I don't understand:
Why sftp would be selecting a random port like that. It seems to be behaving like FTP in passive mode, but I can't make any sense of why that would be.
Why it can even hit my server in the first place if these ports are closed.