Lots of SSH tries on my log. Is it normal?

Question

I have a Raspberry Pi connected to my home and at day 2 of this month I've opened the port 22 of my router so I could SSH it from anywhere. Today by curiosity, I decided to see the raspberry pi log, and I've found lines like this:

Mar 29 07:00:34 raspberrypi sshd[10242]: Failed password for root from 59.63.192.199 port 45555 ssh2 Mar 29 07:00:36 raspberrypi sshd[10242]: Failed password for root from 59.63.192.199 port 45555 ssh2 Mar 29 07:00:38 raspberrypi sshd[10242]: Failed password for root from 59.63.192.199 port 45555 ssh2 Mar 29 07:00:39 raspberrypi sshd[10242]: Received disconnect from 59.63.192.199: 11: [preauth] Mar 29 07:00:39 raspberrypi sshd[10242]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.63.192.199 user=root Mar 29 07:00:50 raspberrypi sshd[10246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.63.192.199 user=root Mar 29 07:00:51 raspberrypi sshd[10246]: Failed password for root from 59.63.192.199 port 38807 ssh2 Mar 29 07:00:53 raspberrypi sshd[10246]: Failed password for root from 59.63.192.199 port 38807 ssh2 Mar 29 07:00:55 raspberrypi sshd[10246]: Failed password for root from 59.63.192.199 port 38807 ssh2

Raspberry pi doesn't even have a root user, but I'm afraid. Is there any possibility something got invaded? I'm just learning to use the raspberry pi and today I was going to set a private key and disable password based SSH login. I'm going to also format the SD card and reinstall Raspbian, just to be sure.

The question is: I can't remember, but I THINK port 22 wasn't open at that the time of this login. Also, what does those port numbers mean? It says port 38807 for example. Where is this port? Aren't they trying to connect to 22?

Answer 1

This question is similar, but not quite the same, as a question I had about my raspberry pi: Closely spaced failed logins in auth.log

From the log, it looks like someone is trying to brute force the root password. (freely available software like hydra will do this). The ports listed after the IP address 59.63.192.199 are the ports on the attacker computer, so they don't have to be 22, their destination will be 22 (ssh) but their source need not be.

The IP address 59.63.192.199 is coming from somewhere in China; a "whois" lookup lists this address as belonging in a block associated with the Jiangxi province network. This IP does respond to ping, but it does not seem to have any of its own first 1000 ports open for you to poke back at...

Luckily for you, the attacker does not know that you have a raspberry pi, which is why they are trying "root" and not "pi".

If you are worried about this you can do a few things to lock down your pi, but still run an ssh server on it: 1) install ufw; 2) install fail2ban; 3) use ssh-keys

ufw is a firewall, which is just generally good to have, and you can use it to blacklist undesirable IP addresses. fail2ban will automatically blacklist people who try to brute force you. Best of all would be to switch to using ssh-keys and disallow username/password entry altogether. You can also switch the ssh server to a non-standard port (use something above 1000) to avoid a lot of routine scans.

Answer 2

There are already numerous questions about this, here, on Serverfault and Unix&Linux. I'm on mobile so I unfortunately can't link them, but if you search for "SSH bruteforce" you'll find a highly upvoted question on each of these sites.

Basically, you should stop thinking your "Raspberry Pi" (gosh I'm starting to hate this name) is something special. It's not, it's just a standard Linux machine and all questions and security procedures that apply to Linux machines also apply to it.

Once you start thinking right you can browse the many questions the SE network has about securing servers.

For your particular case, a quick solution would be to switch to keys and disable password authentication entirely (that takes care of the security issue, so attackers can't do any mischief), and change the SSH port to something non-standard such as 2222 so that you get less noise in your logs (despite switching to keys, these automated break in attempts will continue, and while they can no longer break in they'll still flood your logs).