Aug 10 17:17:34 myhostname sshd[7081]: Bad protocol version identification 'POST /adminport/shutdownTopicRequest HTTP/1.1' from 85.20*.**.** port 60018
Aug 10 17:17:42 myhostname sshd[7082]: Bad protocol version identification 'POST /adminport/shutdownTopicRequest HTTP/1.1' from 85.20*.**.** port 60019
Aug 10 17:17:43 myhostname sshd[7083]: Bad protocol version identification 'POST /adminport/shutdownTopicRequest HTTP/1.1' from 85.20*.**.** port 60020
Aug 10 17:17:50 myhostname sshd[7084]: Bad protocol version identification 'POST /adminport/shutdownTopicRequest HTTP/1.1' from 85.20*.**.** port 60021
Aug 10 17:17:51 myhostname sshd[7085]: Bad protocol version identification 'POST /adminport/shutdownTopicRequest HTTP/1.1' from 85.20*.**.** port 60022
Aug 10 17:17:58 myhostname sshd[7086]: Bad protocol version identification 'POST /adminport/shutdownTopicRequest HTTP/1.1' from 85.20*.**.** port 60023
These are the types of request I get in the auth.log for thousands of ports, in consecutive order, non-stop.
Ideas?
UPDATE:: It was because of the sshd_config non-standard port and some other services (couchbase) was trying to get to the 22 port. Changed the config of the db and it works.
This is actually a Couchbase bug that loops your ports if it cant't use the standard ports. Can be configured otherwise
Couchbase ports required ::
9100 Internal index admin port
9101 Internal index scan port
9102 Internal index HTTP port
9103 Internal index build port
9104 Internal index build port
9105 Internal index maintenance
9998 Internal REST port
9999 GSI for internal admin