I recently configured my external-facing router to forward traffic to port 22 on one machine on my LAN. SSHD is the only service listening on port 22.
Immediately I received traffic from IP addresses such as
188.8.131.52, which according to IP identification websites, have tried to make unauthorized login attempts on thousands of different machines.
When I reviewed
/var/log/auth.log, I saw entries saying that my machine
Received disconnect from 184.108.40.206. I expected to see logs detailing failed login attempts, or more detailed information.
I am running Debian.
Does anyone have any conjectures regarding what those remote machines were trying to do?