Skip to main content
Information Security

Return to Question

deleted 9 characters in body
Source Link
hft
hft
  • 5.3k
  • 19
  • 32

Any help understanding this behavior would be greatly appreciated. Feel free to give references if you are not in the mood to type out an answer. Oh, also, if anyone has any idea as to how my ip address was targeted or if it is just random, I would be interested to hear about it. Cheers.

Any help understanding this behavior would be greatly appreciated. Feel free to give references if you are not in the mood to type out an answer. Oh, also, if anyone has any idea as to how my ip address was targeted or if it is just random, I would be interested to hear about it. Cheers.

Any help understanding this behavior would be greatly appreciated. Feel free to give references if you are not in the mood to type out an answer. Oh, also, if anyone has any idea as to how my ip address was targeted or if it is just random, I would be interested to hear about it.

Tweeted twitter.com/#!/StackSecurity/status/572319258392317952
edited tags
Link
AviD ♦
AviD ♦
  • 73.6k
  • 24
  • 141
  • 222
Source Link
hft
hft
  • 5.3k
  • 19
  • 32

Closely spaced failed logins in auth.log

I have a raspberry-pi (running GNU/Linux) and I recently allowed my router to forward port 22 (ssh) to the raspberry-pi so that I could log in while away from home.

I then noticed a bunch of apparent break-in attempts (failed root logins coming from a chinese ip address) in auth.log, and I have a couple questions about the timing of the failed root logins.

Here's a snippet from my /var/log/auth.log file (the first number is just the line number from vi):

5966 Sep  7 11:50:19 raspberrypi sshd[13759]: Failed password for root from 122.225.103.125 port 34328 ssh2
5967 Sep  7 11:50:20 raspberrypi sshd[13755]: Failed password for root from 122.225.103.125 port 32582 ssh2
5968 Sep  7 11:50:20 raspberrypi sshd[13763]: Failed password for root from 122.225.103.125 port 35381 ssh2
5969 Sep  7 11:50:21 raspberrypi sshd[13759]: Failed password for root from 122.225.103.125 port 34328 ssh2
5970 Sep  7 11:50:22 raspberrypi sshd[13763]: Failed password for root from 122.225.103.125 port 35381 ssh2
5971 Sep  7 11:50:24 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5972 Sep  7 11:50:24 raspberrypi sshd[13763]: Failed password for root from 122.225.103.125 port 35381 ssh2
5973 Sep  7 11:50:25 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5974 Sep  7 11:50:26 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5975 Sep  7 11:50:26 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5976 Sep  7 11:50:28 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5977 Sep  7 11:50:28 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5978 Sep  7 11:50:29 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5979 Sep  7 11:50:31 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5980 Sep  7 11:50:31 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5981 Sep  7 11:50:31 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5982 Sep  7 11:50:33 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5983 Sep  7 11:50:33 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5984 Sep  7 11:50:34 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5985 Sep  7 11:50:35 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5986 Sep  7 11:50:35 raspberrypi sshd[13771]: Failed password for root from 122.225.103.125 port 40360 ssh2
5987 Sep  7 11:50:36 raspberrypi sshd[13767]: Failed password for root from 122.225.103.125 port 39706 ssh2
5988 Sep  7 11:50:37 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2
5989 Sep  7 11:50:38 raspberrypi sshd[13779]: Failed password for root from 122.225.103.125 port 46112 ssh2
5990 Sep  7 11:50:39 raspberrypi sshd[13775]: Failed password for root from 122.225.103.125 port 41540 ssh2

And, here's a snippet from my /etc/pam.d/login file (the first number is just the line number from vi):

9 auth       optional   pam_faildelay.so  delay=3000000

As you can see the delay is set in pam.d/login to three seconds... However the failed root logins are coming at about 1 second apart. How is this possible? Is it because the logins are coming from different ports or ttys? Also, when I try to emulate this behavior myself by putting in the wrong root password, I find that after three attempts I get disconnected and this shows up in auth.log like:

231 Sep 17 11:51:57 raspberrypi sshd[17591]: Failed password for root from 192.168.42.71 port 34208 ssh2
232 Sep 17 11:52:01 raspberrypi sshd[17591]: Failed password for root from 192.168.42.71 port 34208 ssh2
233 Sep 17 11:52:04 raspberrypi sshd[17591]: Failed password for root from 192.168.42.71 port 34208 ssh2
234 Sep 17 11:52:04 raspberrypi sshd[17591]: Connection closed by 192.168.42.71 [preauth]

My three failed attempts are spaced out by at least 3 seconds (as specified in pam.d/login). How is it possible for whoever is trying to break in to make more that one attempt every three seconds and why is the connection not being closed after three failed attempts?

Any help understanding this behavior would be greatly appreciated. Feel free to give references if you are not in the mood to type out an answer. Oh, also, if anyone has any idea as to how my ip address was targeted or if it is just random, I would be interested to hear about it. Cheers.