I'd be more curious to know what these SSH scanner bots actually do if they manage to log in. Automated recon, install spambot/cryptominer/phishing site, something else?
If you the target look like you have money they may install ransomware and encrypt some of your files. Now I want to watch the Beekeeper again as corny as it was, also fun.
Last time I saw this an obscure single letter root password was still "secure", now days seems like almost all non-alphanumeric chars works. % is my new root password it still has not been brute forced.
There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git.
This is a terrible idea because it's blacklist-based security. Places like GitHub have their own ssh server that only runs the git server and nothing else.
That's a hack. It's a login shell that, once you have already logged in and run the shell, prints a message saying you can't log in or run a shell, and then exits.
It does not stop you from, say, logging in to SSH and then starting a port forward. Or running a command in a way that bypasses the login shell. ssh will always pass it to your login shell but other ways can be vulnerable.
Back when it was called Backtrack if my memory serves right. I remember being puzzled that it was not the case anymore one day and they even switched to regular user around when Kali became a thing
- If anything looks interesting on their console they will log in and poke around.
- Install Proxies, DDoS Agents, Bitcoin mining, proxy to SMTP servers, etc...
If you the target look like you have money they may install ransomware and encrypt some of your files. Now I want to watch the Beekeeper again as corny as it was, also fun.
- Installing a cryptominer or persistence tool
- Sending spam (smtp)
- Using pre-obtained credentials to log into various ecommerce/social media sites
This is a terrible idea because it's blacklist-based security. Places like GitHub have their own ssh server that only runs the git server and nothing else.
https://www.man7.org/linux/man-pages/man8/nologin.8.html
It does not stop you from, say, logging in to SSH and then starting a port forward. Or running a command in a way that bypasses the login shell. ssh will always pass it to your login shell but other ways can be vulnerable.
It is a common username (see: https://en.wikipedia.org/wiki/Toor_(Unix) ), the machine I am typing this on has it.
If we are going to be clever we should follow the statistics and go for 12 that where not on the toplist!!
12 - Rank 318
21 - Rank 523
I'm surprised that '12' is so low on the list.