ssh attack

syamajala · 2010-06-19 12:55:44

I think someone is trying to break into my system. I was looking through /var/log/auth.log and found a bunch of ssh attempts.

Jun 18 19:24:19 arch sshd[5810]: Failed password for invalid user test from 61.183.248.218 port 55306 ssh2
Jun 18 19:24:21 arch sshd[5812]: Invalid user test from 61.183.248.218
Jun 18 19:24:21 arch sshd[5812]: pam_unix(sshd:auth): check pass; user unknown
Jun 18 19:24:21 arch sshd[5812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.183.248.218 
Jun 18 19:24:24 arch sshd[5812]: Failed password for invalid user test from 61.183.248.218 port 56944 ssh2
Jun 18 19:24:26 arch sshd[5814]: Invalid user webmaster from 61.183.248.218
Jun 18 19:24:26 arch sshd[5814]: pam_unix(sshd:auth): check pass; user unknown
Jun 18 19:24:26 arch sshd[5814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.183.248.218 
Jun 18 19:24:29 arch sshd[5814]: Failed password for invalid user webmaster from 61.183.248.218 port 58163 ssh2
Jun 18 19:24:31 arch sshd[5816]: Invalid user username from 61.183.248.218
Jun 18 19:24:31 arch sshd[5816]: pam_unix(sshd:auth): check pass; user unknown
Jun 18 19:24:31 arch sshd[5816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.183.248.218 
Jun 18 19:24:33 arch sshd[5816]: Failed password for invalid user username from 61.183.248.218 port 59791 ssh2
Jun 18 19:24:36 arch sshd[5818]: Invalid user user from 61.183.248.218
Jun 18 19:24:36 arch sshd[5818]: pam_unix(sshd:auth): check pass; user unknown
Jun 18 19:24:36 arch sshd[5818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.183.248.218 
Jun 18 19:24:38 arch sshd[5818]: Failed password for invalid user user from 61.183.248.218 port 33148 ssh2
Jun 18 19:24:40 arch sshd[5820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.183.248.218  user=root
Jun 18 19:24:43 arch sshd[5820]: Failed password for root from 61.183.248.218 port 33962 ssh2
Jun 18 19:24:45 arch sshd[5822]: Invalid user admin from 61.183.248.218
Jun 18 19:24:45 arch sshd[5822]: pam_unix(sshd:auth): check pass; user unknown
Jun 18 19:24:45 arch sshd[5822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.183.248.218 
Jun 18 19:24:47 arch sshd[5822]: Failed password for invalid user admin from 61.183.248.218 port 35528 ssh2
Jun 18 19:24:49 arch sshd[5824]: Invalid user test from 61.183.248.218
Jun 18 19:24:49 arch sshd[5824]: pam_unix(sshd:auth): check pass; user unknown
Jun 18 19:24:49 arch sshd[5824]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.183.248.218

What can I do about this? This system is my firewall/wireless access point/home server. They will never be able to log in as root with ssh, because i setup ssh to never allow remote root login, and because the root user has been disabled. Its shell is /bin/false. The only way to do anything is with sudo.

Allan · 2010-06-19 12:58:38

block that ip address.

There is a program that blocks ip address after a certian number of failed attempts but I can not remember what it is called...

mikesd · 2010-06-19 13:42:13

Allan wrote:

block that ip address.
There is a program that blocks ip address after a certian number of failed attempts but I can not remember what it is called...

fail2ban.

You can also use a couple of iptables rules to block repeated failed ssh connections:

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --rttl --seconds 60 --hitcount 8 -j DROP

fail2ban is probably the easiest and more versatile solution.

Last edited by mikesd (2010-06-19 13:42:50)

AngryKoala · 2010-06-19 13:44:01

If you use keys, wouldn't it just deny the connection?

Stebalien · 2010-06-19 14:15:43

Change your ssh port number; Most automated attack scripts don't bother scanning for ssh servers running on non standard ports.

mikesd · 2010-06-19 14:24:07

AngryKoala wrote:

If you use keys, wouldn't it just deny the connection?

I only allow key based authentication for publicly accessible servers though I still block brute force attempts. If nothing else it reduces the size of my log files.

Nepherte · 2010-06-19 14:34:53

mikesd wrote:

Allan wrote:
block that ip address.
There is a program that blocks ip address after a certian number of failed attempts but I can not remember what it is called...
fail2ban.

Denyhosts is another viable solution.

jt512 · 2010-06-19 15:14:07

Other than keeping your log files short, since the SSH daemon is denying them access anyway, is there any point in doing anything else? I get hundreds to thousands of failed logins daily.

ataraxia · 2010-06-19 15:27:43

Stebalien wrote:

Change your ssh port number; Most automated attack scripts don't bother scanning for ssh servers running on non standard ports.

I do this. After changing the port to a random high-numbered one, I haven't had any break-in attempts at all in over a year. (I also accept only keys for login.)

crankyadmin · 2010-06-21 09:04:00

Here is another vote for fail2ban. I set mine up to only accept keys and ban after one failed login attempt.

With keys you'll never get denied access and without it you'll get access denied.

Ashren · 2010-06-21 09:14:33

Use a high numbered port, restrict access to a single user and specific IP ranges using PAM (/etc/security/access.conf). Or use a combination of IP restrictions in /etc/hosts.allow and PAM.

I like PAM.

Arch Linux

#1 2010-06-19 12:55:44

ssh attack

#2 2010-06-19 12:58:38

Re: ssh attack

#3 2010-06-19 13:42:13

Re: ssh attack

#4 2010-06-19 13:44:01

Re: ssh attack

#5 2010-06-19 14:15:43

Re: ssh attack

#6 2010-06-19 14:24:07

Re: ssh attack

#7 2010-06-19 14:34:53

Re: ssh attack

#8 2010-06-19 15:14:07

Re: ssh attack

#9 2010-06-19 15:27:43

Re: ssh attack

#10 2010-06-21 09:04:00

Re: ssh attack

#11 2010-06-21 09:14:33

Re: ssh attack

Board footer