'sshd[xxx]: Bad protocol version identification 'XX' from a.b.c.d' or 'Did not receive identification string from a.b.c.d' in /var/log/secure
Issue
The messages log contains entries similar to those given below.
Mar 12 22:31:14 hostname sshd[772]: Did not receive identification string from a.b.c.d
Mar 12 22:31:14 hostname sshd[820]: Did not receive identification string from a.b.c.d
Mar 12 22:33:38 hostname vsftpd(pam_unix)[855]: check pass; user unknown
Mar 12 22:33:38 hostname vsftpd(pam_unix)[855]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=a.b.c.d
Mar 12 22:33:40 hostname sshd[857]: Did not receive identification string from a.b.c.d
Mar 12 22:33:40 hostname sshd[858]: Address a.b.c.d maps to station.example.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Mar 12 22:33:40 hostname vsftpd(pam_unix)[855]: check pass; user unknown
Mar 12 22:33:40 hostname vsftpd(pam_unix)[855]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=a.b.c.d
Mar 12 22:33:43 hostname vsftpd(pam_unix)[860]: check pass; user unknown
Mar 12 22:33:43 hostname vsftpd(pam_unix)[860]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=a.b.c.d
Mar 12 22:33:45 hostname vsftpd(pam_unix)[860]: check pass; user unknown
Mar 12 22:33:45 hostname vsftpd(pam_unix)[860]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=a.b.c.d
....
Mar 12 22:35:07 hostname sshd[954]: Bad protocol version identification 'id' from a.b.c.d
Mar 12 22:35:28 hostname sshd[999]: Did not receive identification string from a.b.c.d
Mar 12 22:35:45 hostname sshd[1002]: Did not receive identification string from a.b.c.d
Mar 12 22:35:49 hostname sshd[1003]: Did not receive identification string from a.b.c.d
Mar 12 22:36:01 hostname sshd[1013]: Did not receive identification string from a.b.c.d
Mar 12 22:38:29 hostname sshd[15088]: Bad protocol version identification 'GET / HTTP/1.0' from 192.168.122.1
Environment
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- openssh
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
