0

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu machine). Fail2ban is blocking these IPs but I do not understand how they are coming to my VM.

What can be happening?

PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.7  user=root
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.7 

Failed password for root from 121.18.238.7 port 60579 ssh2
message repeated 2 times: [ Failed password for root from 121.18.238.7 port 60579 ssh2]
Improve this question
4
  • 1
    Just on a quick side note. SSH should be running its privileged port 22. Changing the port reduces the amount of log entries, but is more dangerous. Here's a full article explaining it: adayinthelifeof.nl/2012/03/12/…
    – Potaito
    Commented Jul 7, 2016 at 16:08
  • @potAito I disagree. if you are using SSH keys (which you should be using anyway) this attack will have no effect since there is no password to steal.
    – André Borie
    Commented Aug 6, 2016 at 16:07
  • Are you sure you have a network security group set up with rules to block inbound ssh and that network security group is assigned to your vm? On the nsg resource you can click "effective security rules" to check the ruleset, and on your vm network settings you can check the assigned nsg. And I just realized this is a months old question. Will still leave my comment here. :)
    – Gabor Lengyel
    Commented Dec 5, 2016 at 0:28
  • @GaborLengyel Thank you for your answer, since a few months ago robots are not getting to my VM's and I didn't changed security configurations in Azure.
    – jdmorei
    Commented Jan 13, 2017 at 12:08

1 Answer 1

Reset to default
1

No need to worry, these are just typical attempts to find vulnerable servers. You've Fail2Ban already installed, this way you decrease the brute force attempts.

Improve this answer
4
  • Change your default ssh port too, it will reduce the attempts.
    – ThoriumBR
    Commented Jun 7, 2016 at 13:38
  • Thank you !! I don't understand if I can't doing login, I can't began tcp handshake because SSH in Azure is closed, how can they doing this?
    – jdmorei
    Commented Jun 7, 2016 at 14:38
  • Can you access port 22/tcp yourself?
    – ndrix
    Commented Jun 7, 2016 at 22:41
  • Hi M1ke, I can't access throw Internet. I access throw a VPN. This is the problem, I don't understand nothing :S
    – jdmorei
    Commented Jun 8, 2016 at 8:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .