Every scanner tells you its name
Every SSH client sends a version string before authentication. Collected from a few hours on an exposed server, those strings separate real clients from mass scanners and custom bruteforce tools, which makes them useful to alert on.
Every tool that scans you announces itself. Here are the names.
Before any password is tried, both sides of an SSH connection exchange a version string. It is the first thing sent, it is unauthenticated, and almost nobody looks at it.
Ninety sessions reached this server in a few hours, using eighteen different clients. The most common by far is a custom one written in Go, which no human uses to log in. Then a graphical Windows client, then a port scanner in three variants, then a key scanner and a library used for automation. Real interactive clients are a small minority.
That makes the version string a cheap signal. A library or a scanner talking to your SSH port is not a colleague who mistyped a password, and you can alert on that distinction before a single credential is tried.
Alert on the client string, not just the failed password.
#linux#security#ssh#monitoring#sysadmin
❯ Alert on the client string, not just the failed password.