Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone maintain lists of the most frequently guessed account names that are used by attackers brute-forcing ssh?

For your amusement, from my main server's logs over the last month (43 313 failed ssh attempts), with root not getting as far as sshd:

cas@txtproof:~$ grep -e sshd /var/log/auth* | awk ' { print $8 }' | sort | uniq -c | sort | tail -n 13
     32 administrator
     32 stephen
     34 administration
     34 sales
     34 user
     35 matt
     35 postgres
     38 mysql
     42 oracle
     44 guest
     86 test
     90 admin
share|improve this question
up vote 2 down vote accepted

I would start with a web search:

Of particular note, this document seems to have a list that at least seems possible:

share|improve this answer
Would you mind if I appended in a summary of that paper to your answer? I like the paper, and think it would be good if it inspired a larger study. – Charles Stewart Dec 17 '14 at 14:10
Of course not! Go for it. – Michael Graff Dec 19 '14 at 15:55

These are Top 10 from lastb at my box, couple of monts ago:

[contact] => 25
[support] => 28
[info] => 35
[user] => 36
[mysql] => 43
[postgres] => 45
[guest] => 62
[test] => 104
[admin] => 106
[root] => 581
share|improve this answer
I did not know about lastb. Very interesting command. +1 – Puddingfox Jun 2 '11 at 15:13

I suppose you could look through a database of exploit scripts from security sites and compile a list, or you could probably derive them from your own logs of data and use another script to periodically check for outliers to see when they change, but you might reduce your attack surface just a little bit if you put Denyhosts on the system to block IP's automatically after a set of bad credentials (and auto-blocking what other denyhost sites have blocked periodically) and/or put sshd on another port and have your authorized users shift to that port (non-standard ports will make your automated attacks drop to practically nothing).

Don't know if you're looking for these names for a set purpose or if you're interested in reducing your script attack attempts...But it sounds like you're already getting a decent size sample from which to get usernames from scripted attacks.

share|improve this answer
I've had an increase in brute force attacks, and while, for now, I'm happy enough with an increased retry delay, I'm thinking about other strategies. I don't want to block IPs that ssh to the wrong username, because of typos, but blocking IPs that ssh to blacklisted usernames, well... – Charles Stewart Apr 6 '10 at 10:20
denyhosts can be configured for blocking the IP for specific periods as well as a certain number of tries. For example, if the person tries logging in from the same ip incorrectly five times, they're blocked for 1/2 an hour. Or a day. Or forever. Whatever you want. Denyhosts also can collect from other denyhosts users who have blocked attempts from bad IP's. If you have known-good IP's people ssh in from, you can whitelist them to permanently be allowed. I'd recommend you try it out and see what you think. – Bart Silverstrim Apr 6 '10 at 12:39
I've changed the accepted answer to Michael's post, because the paper he links to is well worth reading. – Charles Stewart Dec 17 '14 at 14:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.