Not your validator
Three of the top six attempted usernames are Solana validator account names, with passwords to match. Not a generic wordlist — a purpose-built one aimed at a specific category of operator, sprayed at every reachable SSH port.
Three of the top six usernames tried here are Solana validator account names. The machine runs no validator.
Root and admin at the top — expected. Slots three, five, and six are not generic.
Sort the top ten by count. Root, five hundred seventy-seven. Admin, two hundred fourteen. Then solana at one hundred sixty-three, third overall. Ubuntu. Solv at one hundred, sol at eighty. Three Solana validator account names inside the top six. The passwords match: sol, solana, solv one two three, sol one two three. Each password mirrors its username.
This machine runs no Solana validator. Didn’t matter. The list is sprayed at every reachable SSH port because a false positive costs the sender nothing. Running blockchain infrastructure puts you in a named category. Not running it puts you in the spray anyway.
Key-only auth removes the attack surface, targeted or not.
#linux#security#ssh#blockchain#sysadmin
❯ Key-only auth removes the attack surface, targeted or not.