9

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after reviewing the log file was that all of the IP addresses are Chinese.

Here are the last 10 lines of failed login attempts:

$ cat auth.log | grep Failed | tail -n10
Jan 22 13:42:14 servername sshd[10306]: Failed password for root from 183.3.202.104 port 10894 ssh2
Jan 22 13:42:18 servername sshd[10306]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 10894 ssh2]
Jan 22 13:42:28 servername sshd[10365]: Failed password for root from 183.3.202.104 port 34140 ssh2
Jan 22 13:42:32 servername sshd[10365]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 34140 ssh2]
Jan 22 13:42:44 servername sshd[10423]: Failed password for root from 183.3.202.104 port 56290 ssh2
Jan 22 13:42:48 servername sshd[10423]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 56290 ssh2]
Jan 22 13:43:03 servername sshd[10511]: Failed password for root from 183.3.202.104 port 64153 ssh2
Jan 22 13:43:08 servername sshd[10511]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 64153 ssh2]
Jan 22 13:43:18 servername sshd[10569]: Failed password for root from 183.3.202.104 port 33472 ssh2
Jan 22 13:43:23 servername sshd[10569]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 33472 ssh2]

When searching for non 183.3.202.104 IP addresses, the lines become:

$ cat auth.log | grep Failed | grep -v 183.3.202.104 | tail -n10
Jan 22 02:36:41 servername sshd[31074]: message repeated 5 times: [ Failed password for root from 221.203.142.71 port 33746 ssh2]
Jan 22 02:36:54 servername sshd[31388]: Failed password for root from 221.203.142.71 port 57792 ssh2
Jan 22 02:37:13 servername sshd[31388]: message repeated 5 times: [ Failed password for root from 221.203.142.71 port 57792 ssh2]
Jan 22 02:37:25 servername sshd[31698]: Failed password for root from 221.203.142.71 port 55440 ssh2
Jan 22 02:37:41 servername sshd[31698]: message repeated 5 times: [ Failed password for root from 221.203.142.71 port 55440 ssh2]
Jan 22 02:37:58 servername sshd[31918]: Failed password for root from 221.203.142.71 port 50225 ssh2
Jan 22 02:38:13 servername sshd[31918]: message repeated 5 times: [ Failed password for root from 221.203.142.71 port 50225 ssh2]
Jan 22 04:55:23 servername sshd[22179]: Failed password for invalid user support from 113.160.158.43 port 61614 ssh2
Jan 22 09:36:40 servername sshd[4160]: Failed password for invalid user a from 115.182.249.11 port 53046 ssh2
Jan 22 09:36:52 servername sshd[4204]: Failed password for invalid user oracle from 115.182.249.11 port 56673 ssh2

So first of all, I'd like to confirm that this is indeed an attack; I'm very unfamiliar with managing system security. Second, I'd like to know if there's any way to block all Chinese IP addresses; my server has so far been used solely in America and has nothing to do with China.

  • 2
    If they tried to log in as root, it's an attack. – Philip Rowlands Jan 25 '16 at 14:11
  • 2
    A good search phrase is "geoip blocking" in whatever search engine you prefer. You may also want to look at "fail2ban". – Jenny D Jan 25 '16 at 14:30
  • 4
    To actively block ip's you might want to install fail2ban which blocks ip's after x failed attempts. – BadSkillz Jan 25 '16 at 14:38
  • 1
    @BadSkillz I like fail2ban. Good suggestion. – Mark Buffalo Jan 25 '16 at 14:45
  • 1
    @PhilipRowlands An attempt to log in as root is not necessarily an attack. It might be the person just connected to the wrong host by accident. Of course in that case the person would also have to be clueless enough to type their root password over an ssh connection that had not successfully verified the host key. There is however a different reason to think it is an attack, and that is that there are many repeated failed passwords. – kasperd Jan 25 '16 at 16:08
8

You can try Wizcraft's block list, and format it accordingly. At the time of my post, this blocklist was last updated on Thursday, 24-Dec-2015 11:01:52 MST. Keep in mind, Taiwan is not part of Mainland China, but that Hong Kong now belongs to, and is controlled by Beijing.

If you only use your server in America exclusively, you could use all of those rules to block attackers. If not, edit out the ones you don't want, and keep the ones you do.

Also keep in mind, this will not stop attackers from connecting to a VPN in a country of their choice, and once again attempting to login as root. This is merely a band-aid.

EDIT - BadSkillz and Jenny D have recommended fail2ban. This will probably be a better solution overall, but it probably wouldn't hurt to use both methods.

3

I also find it disturbing to see these low brow brute force login attempts and sadly yes they are mostly from China ( 'Vacuum cleaner' espionage ) - Good news is the solution is simple - only permit login to your server using SSH keys which then enables you to disable passwords as a login method

First create your secure SSH keys :

see doc for linux/OSX/Windows https://help.github.com/articles/generating-a-new-gpg-key/

in a terminal on your local box issue

ssh-keygen -t rsa -b 4096 -C "youremailaddr@example.com"

this will prompt you for a password (remember it) ... it will create a private and public key pair of files

private file  /home/mylogin/.ssh/id_rsa_supermoon
public file   /home/mylogin/.ssh/id_rsa_supermoon.pub

These files are now local to your machine ... just copy the public file onto your remote server and place into file (or append to)

/home/mylogin/.ssh/authorized_keys

assure it has proper file permissions on remote host

chmod 700 /home/mylogin/.ssh
chmod 600 /home/mylogin/.ssh/authorized_keys

Now back on your local host issue this to ssh login to your remote box

# only need to issue this set of 3 cmds once on same terminal
export REMOTE_IP=1.2.3.4 # your remote host IP
eval $(ssh-agent)
ssh-add ~/.ssh/id_rsa_supermoon  # enter same password as above

ssh mylogin@${REMOTE_IP}

* Start of Optional ------------ *

PS - sick of password prompts on every ssh then put this into your local ~/.bashrc

if [ ! -S ~/.ssh/ssh_auth_sock ]; then
  eval $(ssh-agent)
  ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
fi
export SSH_AUTH_SOCK=~/.ssh/ssh_auth_sock
ssh-add -l | grep "The agent has no identities" && ssh-add ~/.ssh/id_rsa_supermoon

------------ End of Optional

IMPORTANT - confirm you can correctly login using ssh ... ONLY then on your remote host edit the ssh config file

sudo vi /etc/ssh/sshd_config  
# PasswordAuthentication yes   # we do NOT want yes if ssh keys work
PasswordAuthentication no

to engage above config file change on remote host just bounce ssh server :

sudo service sshd restart  # (systemd ONLY) this does not kill your login session

Done - You will immediately see no more such brute login attempts since your remote host now summarily ignores password attempts and those guttersnipes will crawl away to pester someone else's unprotected server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.