Recently set up a server, Need security help

Question

I set up a server running debian I opened port 22 allowing access to ssh into the port. I keep getting weird messages in my router log saying: [LAN access from remote] from 211.161.46.101:57201 to 10.xx.xx.xx:22

I looked up the ip address and it said something about being from Beijing. Am I being hacked? I changed the password on the server login once already and now its saying the same thing but with a different ip address.

Answer 1

There are four things I would recommend to keep your SSH more secure and prevents attacks like that. I can't necessarily say if he actually made his way into your box, or if he just attempted and failed, but definitely change some of these options so it'll be much harder for something like this to happen in the future.

• Disable root logins: You want to make sure if someone is logging in through SSH, they won't be able to have root access right away
• Enable Public Key Authentication: Sadly this part does take a little more time to implement, but it's much better and will definitely help prevent unauthorized logins.
• Change the default port: This is a little more of security through obscurity but your server was more than likely found because there is a random bot scanner scanning random IPs for an open port(22). If you change it to something else(somewhere in the 3000-10000 range), it's much less likely to be picked up by a scanner.
• You can use a blacklisting program like DenyHosts or others that allow you to blacklist certain IPs after a certain number of failed attempts.

In terms of seeing of whether your server has been compromised, check your ssh logs. It'll let you know what usernames were attempted for login, and if they were successful in doing so.

Answer 2

I'm A Person lists some good steps. I would add that using the AllowUsers directive in sshd_config allows you to specify that only certain users can log in - e.g. "AllowUsers imaperson" means that imaperson can log in but any attempt to log into root, apache, postgres, or whatever other accounts exist on the system would fail, even with a correct password. This takes things a step further than 'PermitRootLogin no'.

To answer your larger question, you're not being hacked per se; you're being automatically scanned. It goes on almost continuously and blindly on the Internet, which is why I'm A Person's advice about the default port is useful. My personal server had about 200 attempts in the last 12 hours, which is normal or even low. It's generally noise and not a targeted attack on you.

Failed attempts in the last 12 hours:

145 root
 10 bin
  1 mail
  1 news
  1 postgres