What can be learned about a 'user' from a failed malicious SSH attempt?
- User name entered (
- Password entered (if configured, i.e. by using a PAM module)
- Source IP address (
Are there any methods of extracting anything else? Whether it's info hidden in log files, random tricks or from 3rd party tools etc.