Strange SSHD login user name

[DoN. Nichols]

Has anyone else seen SSHD login attempts with a username of "____" ?

I've seen nine of them so far, starting back around 2012-05-13.

Is there any unix system which even would accept that as a
username? (I've not tried to create one on my systems, so I don't
know.)

I presume that if it is possible it is most likely installed by
a rootkit, not by a real administrator anywhere. (And if not possible,
what other OS's would allow such a username?

Thanks,
DoN.


--
Remove oil spill source from e-mail
Email: <BPdnic...@d-and-d.com> | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

[Doug McIntyre]

"DoN. Nichols" <BPdnic...@d-and-d.com> writes:
>Has anyone else seen SSHD login attempts with a username of "____" ?

No, but then again I filter sshd off from the general internet as well.
It is probably being scanned because there were successful hits using it.

> Is there any unix system which even would accept that as a
>username? (I've not tried to create one on my systems, so I don't
>know.)

Probably all of them.

Solaris docs says that _ is an acceptable value in a login name, although
it should start with an alpha, it is only a warning not to.

[DoN. Nichols]

On 2012-10-16, Doug McIntyre <mer...@geeks.org> wrote:
> "DoN. Nichols" <BPdnic...@d-and-d.com> writes:
>>Has anyone else seen SSHD login attempts with a username of "____" ?
>
> No, but then again I filter sshd off from the general internet as well.
> It is probably being scanned because there were successful hits using it.

I would have it blocked off too -- except that I need to allow a
*certain* amount of access to a couple of other people to one or two
systems. Needless to say, I test the passwords from time to time. :-)

If it has worked, it probably was because a rootkit installed
it. I've read that another which I see tried from time to time --
"fluffy" was a rootkit installation.

I usually see it tried only along with "root" -- and
occasionally "toor" -- not with the gazillions of usernames tried. The
attacks which start out "aa", "ab", "ac" ... are sort of reassuring, in
that I would never use that short a username, so they can waste as much
time as they like trying two-letter usernames. Gets to the point
where the firewall slams the door more quickly. :-)

>> Is there any unix system which even would accept that as a
>>username? (I've not tried to create one on my systems, so I don't
>>know.)
>
> Probably all of them.

O.K. I might try it on some system which is not visible to the
outside, but certainly not anything which is visible -- unless I were to
try setting up honeypots. :-)

> Solaris docs says that _ is an acceptable value in a login name, although
> it should start with an alpha, it is only a warning not to.

O.K. So it will probably work.