Three hundred and twenty-two attempts, no chance

"Have there been intrusion attempts?" The honest answer is yes, three hundred and twenty-two, from a hundred and thirty-three addresses. The useful answer is: none of them could have worked, and here is why we can say so.

1. The raw number means nothing

A server reachable from the internet receives connection attempts constantly. It is not a sign that anyone is interested in you: programs walk through addresses one by one and try the most common account names against anything that answers.

Ours were unsurprising: the classic admin account first with eighty-three tries, then names derived from the domain, then the generic "user". That is the signature of an automated sweep, not a targeted visit. Someone actually aiming at you does not start by trying "admin".

Announcing "three hundred and twenty-two intrusion attempts" with nothing else is producing worry without information. The number measures exposure to the internet, not risk.

2. What turns a number into an answer

The interesting question is not "how many tried", it is "what would have happened if one of them had guessed right". And there, the log answers by itself.

All three hundred and twenty-two attempts targeted a password. But password authentication is disabled on this machine: only a cryptographic key opens the door. An attacker who guesses the right password is refused exactly like one who guesses wrong. The success rate is not low: it is zero.

Only then come the wear-and-tear protections — turning away persistent addresses, limiting the pace. That is useful — it cuts noise and load — but it is the second line. The first was removing the lock those people were trying to pick.

3. Where to look for the real answer

Failures are loud and reassuring. Successes are quiet and decisive. That is the list to read, and it is short.

In our case, every successful connection used a key, on the expected account, from a small number of origins, all of them expected. Every key fingerprint matches an authorized key we can name. No accepted connection came from a key we could not identify.

That sentence is the answer — not the three hundred and twenty-two.

4. The check we keep

We also verified what nobody thinks to verify: every known way to leave a door open without it appearing in the list of keys — a privileged account that can be reached directly, a command forced on connection, a key source consulted elsewhere, a network-level tunnel. The list of what is closed on our side stays on our side: what matters is re-reading it regularly.

Looking at these points takes a few minutes. Not looking means declaring a machine healthy after inspecting only the front entrance.

🔭