This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Email Alerts - User '-' failed to login from 'X.X.X.X' using ssh because of wrong credentials

I keep getting email alerts from my Sophos XG every other 2 minutes with below error message:-

User '-' failed to login from '192.168.0.5' using ssh because of wrong credentials. At first, the from IP address was random public IP addresses instead of the local IP '192.168.0.5'. After I disabled SSH access from WAN. It then changed to the local IP. This IP is just a file server on the network and has no other services installed on it.

I cant seem to find a solution to this answer from any of the blogs. What could be causing this and how can it be resolved?

Your help will be much appreciated.

This thread was automatically locked due to age.

0 rfcat_vk over 5 years ago

Hi,

Do you have external access to your XG enabled. if so disable it?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 5 years ago

Scan the file server if there are any malware on it. You could use a wireshark or tcpdump or other utility to record traffic to XG where port is ssh and find the process.
Cancel
Vote Up 0 Vote Down

Cancel