Logs show failed password for invalid user root from <IP Address> port 2924 ssh2
- by Chris Hanson
I'm getting a constant flow of these messages in my logs. The port is variable (seemingly between 1024 and 65535). I can simulate it myself by running
sftp root@<my ip>
I've commented out the sftp subsystem line in my sshd_config. These ports should be closed by provider's firewall.
I don't understand:
Why sftp would be selecting a…