I have a fairly minimal setup server, and it doesn't allow password authentication, only using keys. And it definitely doesn't have Java installed. Normally I don't pay any attention to the thousands of attempts a day of script kiddies to guess my passwords - I figure the time they waste on my system is time they're not wasting on systems that do allow password authentication. But I am seeing this message in /var/log/auth.log:
Dec 7 13:43:43 hostname sshd: Received disconnect from 188.8.131.52: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Is that mention of what looks like a Java exception coming from the attacker, or is that from something on my side?