john9527
Part of the Furniture
That says you don't have the SSH access blocked from the WAN.....double check the settings on the Administration>System page for allow SSH access from WANOk, so you say they just try to scan port 22 from outside, and even though I have configured SSH to not listen on the wan interface, these logs are normal? (this is an UK ip address, I am in Germany):
Jul 7 18:09:39 RT-AC68U-3228 authpriv.info dropbear[8260]: Child connection from 5.152.214.240:9224
Jul 7 18:09:39 RT-AC68U-3228 authpriv.warn dropbear[8260]: Login attempt for nonexistent user from 5.152.214.240:9224
Jul 7 18:09:40 RT-AC68U-3228 authpriv.warn dropbear[8260]: Login attempt for nonexistent user from 5.152.214.240:9224
Jul 7 18:09:40 RT-AC68U-3228 authpriv.warn dropbear[8260]: Login attempt for nonexistent user from 5.152.214.240:9224
Jul 7 18:09:40 RT-AC68U-3228 authpriv.info dropbear[8260]: Exit before auth: Exited normally
Jul 7 18:32:28 RT-AC68U-3228 authpriv.info dropbear[8359]: Child connection from 5.152.214.240:9224
Jul 7 18:32:29 RT-AC68U-3228 authpriv.warn dropbear[8359]: Login attempt for nonexistent user from 5.152.214.240:9224
Jul 7 18:32:30 RT-AC68U-3228 authpriv.warn dropbear[8359]: Login attempt for nonexistent user from 5.152.214.240:9224
Jul 7 18:32:30 RT-AC68U-3228 authpriv.warn dropbear[8359]: Login attempt for nonexistent user from 5.152.214.240:9224
Jul 7 18:32:30 RT-AC68U-3228 authpriv.info dropbear[8359]: Exit before auth: Exited normally
Jul 7 18:55:27 RT-AC68U-3228 authpriv.info dropbear[8467]: Child connection from 5.152.214.240:9224
Jul 7 18:55:28 RT-AC68U-3228 authpriv.warn dropbear[8467]: Login attempt for nonexistent user from 5.152.214.240:9224
Jul 7 18:55:28 RT-AC68U-3228 authpriv.warn dropbear[8467]: Login attempt for nonexistent user from 5.152.214.240:9224
Jul 7 18:55:28 RT-AC68U-3228 authpriv.warn dropbear[8467]: Login attempt for nonexistent user from 5.152.214.240:9224
Jul 7 18:55:29 RT-AC68U-3228 authpriv.info dropbear[8467]: Exit before auth: Exited normally
I thought when I have ssh disabled for WAN, it will not even show up in the logs.
Thanks
Andi