TLS at port 22
Four sessions sent TLS ClientHello bytes to port 22 instead of an SSH banner, from four distinct /16 networks across two days. Port scanners apply their configured protocol to every open port without first checking whether the service matches.
Four scanners sent TLS handshakes to your SSH port.
Port scanning is assumed to be crude — try a password, get rejected. These four connections were more confused than that. They sent HTTPS negotiations to a port that only speaks SSH.
Cowrie logged what each client sent in place of an SSH version string. Three sessions opened with the TLS one point zero record header — bytes sixteen, three, one. The fourth was TLS one point two, different cipher suites, same wrong protocol. Four source networks, all distinct.
Port scanners replay their configured protocol against everything open, without checking whether the service matches first. Your SSH port will see HTTPS before it sees a real SSH client.
Garbled version strings in your SSH logs mean someone aimed the wrong scanner at you.
#linux#security#ssh#networking#sysadmin
❯ Garbled version strings in your SSH logs mean someone aimed the wrong scanner at you.