If we see high number of failed ssh login attempts on SSR 128T conductors or on SSR routers, this needs to be investigated thoroughly, because compromised systems can be used for abusing other systems and can be used for launching attacks like SSH_BRUTE_FORCE.

Seeing high number of failed ssh login attempts on SSR 128T conductors or on SSR routers (as shown here)

root@admin# ssh <conductor IP or SSR router IP>

[email protected]'s password:

Last failed login: Mon Apr 14 06:30:32 EDT 2025 from <Public malicious IP> on ssh:notty

There were 293949 failed login attempts since the last successful login.

Last login: Mon Apr 14 06:26:30 2025 from <IP>

Remediation steps:

Inform your internal Security team urgently and work with them till you identify and remediate the login attempts.

Based on Security team's policy, if needed isolate the system from network and do a thorough check to make sure system is not compromised

If the system is compromised, make sure there are no malicious scripts or binaries placed on the system.

Review /var/log/audit/audit.log for failed login details (source IP destination IP, timestamp etc)

If access to SSR conductor OR SSR router is allowed from Public Internet review the services and access policies which allow them and restrict access only to trusted IPs or via VPNs.

Restrict all unwanted inbound and outbound access to conductors and routers via WAN links (from-to Public Internet)