0

To input journalctl after logining my vps.

journalctl _COMM=sshd -f  

Feb 16 06:34:40 localhost sshd[324]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 38876
Feb 16 06:34:40 localhost sshd[325]: Did not receive identification string from 23.252.100.22
Feb 16 07:34:40 localhost sshd[326]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 40602
Feb 16 07:34:40 localhost sshd[327]: Did not receive identification string from 23.252.100.22
Feb 16 08:34:40 localhost sshd[328]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 38298
Feb 16 08:34:40 localhost sshd[329]: Did not receive identification string from 23.252.100.22
Feb 16 09:34:41 localhost sshd[348]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 42132
Feb 16 09:34:41 localhost sshd[349]: Did not receive identification string from 23.252.100.22
Feb 16 10:34:39 localhost sshd[350]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 60988
Feb 16 10:34:39 localhost sshd[351]: Did not receive identification string from 23.252.100.22
Feb 16 11:34:40 localhost sshd[352]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 33850
Feb 16 11:34:40 localhost sshd[353]: Did not receive identification string from 23.252.100.22
Feb 16 12:34:39 localhost sshd[354]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 44998
Feb 16 12:34:39 localhost sshd[355]: Did not receive identification string from 23.252.100.22
Feb 16 13:34:38 localhost sshd[356]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 52632
Feb 16 13:34:38 localhost sshd[357]: Did not receive identification string from 23.252.100.22
Feb 16 14:34:41 localhost sshd[358]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 43864
Feb 16 14:34:41 localhost sshd[359]: Did not receive identification string from 23.252.100.22
Feb 16 15:34:40 localhost sshd[360]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 53402
Feb 16 15:34:40 localhost sshd[361]: Did not receive identification string from 23.252.100.22

Does the log mean that 23.252.100.22 (not my ip and not my vps ip) try to crack my vps key?

Where is the file containing such log info?

Improve this question

2 Answers 2

Reset to default
1

The client at 23.252.100.22 that is trying to connect to your SSH daemon thinks it's talking to an HTTP server.

The client sends an HTTP GET request while the SSH server actually expects to receive a version identifier - which is why your daemon confuses the HTTP query with an SSH version string and logs that as an error. It's very unlikely that this is related to a particular vulnerability rather than a simple protocol mismatch.

Improve this answer
2

Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 38876

It sounds like a bot is sending incorrectly-formed messages to sshd. Not only is that not a version string, but it's one line of an http request - which doesn't make any sense in the context of ssh.

It could be trying to trigger some vulnerability that I don't know about, but I think it's probably just poorly programmed.

Either way, the answer is the same: do your standard sshd hardening. Disable password auth, disable root login, install and configure fail2ban.

Improve this answer
2
  • It's not a HTTP header rather than the HTTP request line.
    – Arminius
    Commented Feb 25, 2017 at 13:50
  • Oops, you're right. Fixed.
    – Xiong Chiamiov
    Commented Feb 25, 2017 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .