Is someone trying to hack into my server?

Question

I'm a cyber security student and don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked on my server and there were lots of Failed password for root from [IP] This is a newly installed remote server there's no way I could have logged so many times.

Then I read it carefully it says Failed password for root from [IP] I was like what? Its for root? I have created my separate user account and except the first time when I had to create a new user account I have never touch root user. It seems to me someone is trying his luck by bruteforcing for credentials. Still, I wanted to ask my seniors here what they think?

I've nothing running on this server not even apache, nginx etc. Only SSH port is open and AFAIK there's no recent SSH vulnerability in public knowledge.

And one more important thing I wanted to ask is, being a security student this really grabs my attention and makes me more curious to understand about this. Why would someone run scripts to bruteforce and scan new servers? I mean what would he get, there's barely anything in my case. Initially, I thought maybe he wants to spread malware using my server but if someone has the resources to scan the entire internet he surely has resources to do that himself. Maybe he just want to add servers into his list of compromised servers and use all of them together as a botnet, so many thing going on my mind. What would he do with a new server?

EDIT: Something I realized today is, as security student I was understanding things from offensive side. Now when I have setup my server I really understand the need to know things from defensive side as a pentester. If any student reading this, I would say understand defensive side as well. I would also learn from now.

Answer 1

It seems to me someone is trying his luck by bruteforcing for credentials.

Yes, that's the likely cause. Any machine connected to the Internet and listening to SSH will be hammered with login attempts, especially for root.

AFAIK there's no recent SSH vulnerability in public knowledge.

Correct. They're just hoping you have a weak, guessable password.

Why would someone run scripts to bruteforce and scan new servers? ...What would he do with a new server?

Because all servers are useful - as members of a botnet, if nothing else. If they get in, they may use it to scan the Internet looking for weak SSH credentials!

Because some servers are valuable - hey, look, credit card info! - and the attacker doesn't know if yours is valuable or not until he owns it. He won't ignore servers just because they might be less valuable.

Because some servers have access to other servers that aren't publicly available.

Because more is better.

The lesson to learn is that every system on the Internet is a target, all the time. As a security student, that is what you must learn to expect.