1
sshd
error: kex_exchange_identification: client sent invalid protocol identifier "CONNECT hotmail-com.olc.protection.outlook.com:25 HTTP/1.1"

This line appears in logs 2-3 times per month, simply explained I really don't have a clue what's causing it. It's a testing machine with Ubuntu 20.04 LTS running nginx + php + wireguard + cockpit, nothing more

1 Answer 1

2

The internet is full of bots trying to find anything to abuse.

This case looks like a bot that is trying to find an open HTTP proxy and use it to connect to Hotmail's SMTP servers.

3
  • I assume sshd automatically drops the packets of this type of attack or?
    – 1000Gbps
    Mar 26, 2021 at 22:45
  • I would not say that "sshd drops packets". The term "drop" is normally used to describe the work of a firewall, and it means that the packet doesn't even come near sshd. sshd has no notion that this is a malicious HTTP connection request; it just determines that the client doesn't behave according to the protocol, logs that fact and continues listening for the next (correct) connection requests. If you see that these malformed requests come from the same source, and nothing legitimate comes from it, you can use your firewall to block that source entirely. Mar 26, 2021 at 23:36
  • Yeah, ufw settings are DROP ALL except allowed ports. The question is why the ISP doesn't filter scans especially on high ports (in this case 65000) when they are required to do that
    – 1000Gbps
    Mar 28, 2021 at 2:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .