I am running a Gentoo Linux server, and use Fail2Ban to block the script kiddies and their relentless banging on my SSH port. (Yes I know I can move to a different port number, but that is work, and who wants to do that? :) )
So anyway, that is working great, I catch a lot of people trying to break in, and ban them, but then I noticed this interesting message, and LOTS of them.
Oct 12 18:00:57 SERVERNAME sshd[23265]: SSH: Server;Ltype: Version;Remote: 216.177.200.29-46386;Protocol: 2.0;Client: libssh-0.1
There are more than 1000 of them in a 5 min window, all from the same remote IP address. Is this a breakin attempt? And if so, what kind is it? I have tried looking this up, but couldn't get a clear answer on what was going on here.
Because there was no specific attempt to login, my fail2ban didn't flag IPTables to block it. I just wanted to be sure I'm not being exposed to some known vulnerability in the SSHD daemon.