Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've seen something like:

sshd[***]: Invalid user oracle from **.**.**.**                          // 1st line
sshd[***]: input_userauth_request: invalid user oracle [preauth]         // 2nd line
sshd[***]: Received disconnect from **.**.**.**: 11: Bye Bye [preauth]   // 3rd line

and I know that's someone tries to log into my server, but what does it mean when there's only the 3rd line repeating over and over again for, like, 3000+ times?

I mean, like this (there's no Invalid user or input_userauth_request):

sshd[***]: Received disconnect from **.**.**.**: 11: Bye Bye [preauth]
sshd[***]: Received disconnect from **.**.**.**: 11: Bye Bye [preauth]
sshd[***]: Received disconnect from **.**.**.**: 11: Bye Bye [preauth]

What's the purpose of doing so, what's he trying to do since it's "disconnect" instead of trying to login?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

This error rises from a fatal error in the authentication process (see monitor.c of OpenSSH versions 6.1p1+).

It is likely that the attacker is using some custom code to brute-force the server which is ending up in malformed authentication requests being sent, resulting in the server killing the connection. So from the code it appears they are in fact trying to login, but the server doesn't like how they're attempting that.

As such, these log entries aren't anything to worry about unless you think you are likely to be a targeted victim for any reason (in which case you should be taking extra precautions such as refusing password-based logins).

In any case, I suggest you install the simple fail2ban program if you haven't already which will significantly hinder cookie-cutter brute-force authentication attempts.

share|improve this answer
    
Thx. So, since I'm using fail2ban and using SSH key only, my server is safe, right? ;) –  iceX Oct 22 '13 at 12:38
    
Over what period of time are you getting these 3,000+ log entries? Worth investigating that fail2ban is working effectively. There is a delay before it acts but it's possible it doesn't regard this specific log-line as an issue, if it's not just incorrectly setup. –  deed02392 Oct 22 '13 at 12:50
    
fail2ban is up and running, and the reason those entries appeared in the log is because the default fail2ban rules just ignored them and took no action( yes I think you are right that it doesn't regard this specific log-line as an issue). I added some regex to sshd-ddos.conf and now, the log looks fine. :) –  iceX Oct 22 '13 at 13:41
    
Still, felt a bit weird that since the default fail2ban rule doesn't regard this as an issue, then those attempts should be not so dangerous...then...what's the point of doing this kind of attack... –  iceX Oct 22 '13 at 13:45
1  
My gut feeling is the authors of the provided rules expected the associated log entries that you mentioned and so only included those. Re the point of this attack, I do think that the attack is not effective and it's a flaw in their attack versus your specific SSH server, making it effective only as a possible DoS rather than a risk of compromise. It might be an idea to enable debug logging and watch it for a few days to see if the same attack is launched, then spot what specifically they're trying although I can't guarantee even debug logging would capture anything interesting. –  deed02392 Oct 22 '13 at 14:03
show 1 more comment

I use a laptop (running linux) somtimes with a 3G dongle (directly connected to the internet) and I get hundreds of these:

Oct 21 10:11:52 c4111um sshd[8912]: Failed password for invalid user hash from 203.195.182.30 port 36789 ssh2
Oct 21 10:11:53 c4111um sshd[8912]: Received disconnect from 203.195.182.30: 11: Bye Bye [preauth]
Oct 21 10:11:56 c4111um sshd[8914]: Invalid user admin from 203.195.182.30
Oct 21 10:11:56 c4111um sshd[8914]: input_userauth_request: invalid user admin [preauth]
Oct 21 10:11:56 c4111um sshd[8914]: pam_unix(sshd:auth): check pass; user unknown
Oct 21 10:11:56 c4111um sshd[8914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.195.182.3

http://www.infobyip.com/ip-203.195.182.30.html (usually originates from our chums in China)

share|improve this answer
    
yeah, the IP that i'm talking about is from China also :( –  iceX Oct 26 '13 at 2:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.