Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I set up a server running debian I opened port 22 allowing access to ssh into the port. I keep getting weird messages in my router log saying: [LAN access from remote] from 211.161.46.101:57201 to 10.xx.xx.xx:22

I looked up the IP address and it said something about being from Beijing. Am I being hacked? I changed the password on the server login once already and now its saying the same thing but with a different IP address.

share|improve this question
    
What kind of router? It sounds like you may be forwarding traffic... either port forwarding or DMZ host. –  Jeff Ferland Mar 18 '12 at 16:20
add comment

2 Answers

There are four things I would recommend to keep your SSH more secure and prevents attacks like that. I can't necessarily say if he actually made his way into your box, or if he just attempted and failed, but definitely change some of these options so it'll be much harder for something like this to happen in the future.

  • Disable root logins: You want to make sure if someone is logging in through SSH, they won't be able to have root access right away
  • Enable Public Key Authentication: Sadly this part does take a little more time to implement, but it's much better and will definitely help prevent unauthorized logins.
  • Change the default port: This is a little more of security through obscurity but your server was more than likely found because there is a random bot scanner scanning random IPs for an open port(22). If you change it to something else(but preferably something under 1024), it's much less likely to be picked up by a scanner.
  • You can use a blacklisting program like DenyHosts or others that allow you to blacklist certain IPs after a certain number of failed attempts.

In terms of seeing of whether your server has been compromised, check your ssh logs. It'll let you know what usernames were attempted for login, and if they were successful in doing so.

share|improve this answer
1  
+1 All good advice, if anyone needs more info on how to implement some of this a good book I came across recently was michaelwlucas.com/nonfiction/ssh-mastery –  Rоry McCune Mar 18 '12 at 9:34
    
Another useful step, provided the clients you use to access your server can cope, is 2FA auth of some sort. Google has a PAM for this. –  Owen Jan 22 at 17:25
add comment

I'm A Person lists some good steps. I would add that using the AllowUsers directive in sshd_config allows you to specify that only certain users can log in - e.g. "AllowUsers imaperson" means that imaperson can log in but any attempt to log into root, apache, postgres, or whatever other accounts exist on the system would fail, even with a correct password. This takes things a step further than 'PermitRootLogin no'.

To answer your larger question, you're not being hacked per se; you're being automatically scanned. It goes on almost continuously and blindly on the Internet, which is why I'm A Person's advice about the default port is useful. My personal server had about 200 attempts in the last 12 hours, which is normal or even low. It's generally noise and not a targeted attack on you.

Failed attempts in the last 12 hours:

145 root
 10 bin
  1 mail
  1 news
  1 postgres
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.