Description

The syslog will be printed if the ssh attempts are made more than the configured limit. 

Symptoms

The below syslog will be printed if the SSH attempt are made more than the configured limit, indicating exceeding the limit that is configured on the device. 
  
Jun  9 11:21:48  router-name inetd[28754]: %DAEMON-3: ssh from 100.64.132.186 exceeded counts/min (limit 40/min)
Jun  9 11:21:49  router-name inetd[28754]: %DAEMON-3: ssh from 100.64.132.186 exceeded counts/min (limit 40/min)
Jun  9 11:22:49  router-name inetd[28754]: %DAEMON-3: ssh from 100.64.132.186 exceeded counts/min (limit 40/min)
Jun  9 11:22:49  router-name inetd[28754]: %DAEMON-3: ssh from 100.64.132.186 exceeded counts/min (limit 40/min)

 

Solution

The logs will be printed if the ssh attempt are made more than the configured limit on the device from a particular IP.

From the configuration, for the above logs, it was observed that the rate-limit is 40.
  
services {
        ssh {
            root-login deny;
            protocol-version v2;
            connection-limit 40;
            rate-limit 40;
        }


The rate-limit knob in under the services hierarchy inside the ssh service gives the maximum number of connection attempts per minute, per protocol (either IPv6 or IPv4) on an access service. For example, a rate limit of 10 allows 10 IPv6 SSH session connection attempts per minute and 10 IPv4 SSH session connection attempts per minute

In the above scenario, the rate-limit is 40, if the connection/SSH attempts are made more than the rate-limit 
then the log will get printed. 

This log is informational and does not pose any harm. However, check the IP from which ssh attempts are made and if the IP is not familiar, it can be blocked using the firewall filter to avoid multiple ssh attempts.


 

Modification History

2024-06-16 : Article Created