Hi
Today i received a complaint from one of external server that my server keep on delivering ssh attempt on there server by one of my ftp user .Any help me out how can i check number of ssh attempt made by my server


I could int find out the log of my server making ssh attempt on there at partiular schedule time 17:55.


8105 Jan 30 17:52:24 loft sshd[31609]: Failed password for root from 201.45.xxx.719 port 42959 ssh2
8106 Jan 30 17:52:24 loft sshd[31610]: Received disconnect from 201.45.xxx.71: 11: Bye Bye
8107 Jan 30 17:52:26 loft sshd[31612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.45.xx.71 user=root
8108 Jan 30 17:52:27 loft sshd[31612]: Failed password for root from 201.45.xxx.71 port 43768 ssh2
8109 Jan 30 17:52:28 loft sshd[31613]: Received disconnect from 201.45.xxx.71: 11: Bye Bye
8110 Jan 30 18:29:23 loft sshd[32286]: Did not receive identification string from UNKNOWN
8111 Jan 30 18:46:17 loft sshd[317]: Did not receive identification string from 188.138.xxx.168
8112 Jan 30 18:46:18 loft sshd[324]: Did not receive identification string from 188.138.xx.168
8113 Jan 30 20:53:52 loft sshd[6441]: Did not receive identification string from 46.228.1xx.146
8114 Jan 30 20:58:05 loft sshd[6594]: Invalid user minecraft from 46.228.161.146
8115 Jan 30 20:58:05 loft sshd[6595]: input_userauth_request: invalid user minecraft
8116 Jan 30 20:58:05 loft sshd[6594]: pam_unix(sshd:auth): check pass; user unknown


client side i got these log of my server attempt.But when i check out the ssh log of my server i could int find out any instant of ssh hacking

Jan 30 17:55:41: Did not receive identification string from 188.138.xx.177
Jan 30 17:55:48: Did not receive identification string from 188.138.xx.177
Jan 30 17:55:48: Did not receive identification string from 188.138.xx.177
Jan 30 17:59:10: Invalid user sanjay from 188.138.xx.177
Jan 30 17:59:10: Invalid user sanjay from 188.138.xx.177
Jan 30 17:59:14: Invalid user sanjay from 188.138.xx.177
Jan 30 17:59:14: Invalid user sanjay from 188.138.xx.177
Jan 30 17:59:14: Invalid user sanjay from 188.138.xx.177
Jan 30 17:59:14: Invalid user sanjay from 188.138.xx.177

In themselves you'll never have any logs of SSH client usage. Maybe you can get a pattern of attacks from the other party, see if there is a pattern, check all cronjobs on the system for all users etc.