Blocking Chinese IP addresses

Question

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after reviewing the log file was that all of the IP addresses are Chinese.

Here are the last 10 lines of failed login attempts:

$ cat auth.log | grep Failed | tail -n10
Jan 22 13:42:14 servername sshd[10306]: Failed password for root from 183.3.202.104 port 10894 ssh2
Jan 22 13:42:18 servername sshd[10306]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 10894 ssh2]
Jan 22 13:42:28 servername sshd[10365]: Failed password for root from 183.3.202.104 port 34140 ssh2
Jan 22 13:42:32 servername sshd[10365]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 34140 ssh2]
Jan 22 13:42:44 servername sshd[10423]: Failed password for root from 183.3.202.104 port 56290 ssh2
Jan 22 13:42:48 servername sshd[10423]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 56290 ssh2]
Jan 22 13:43:03 servername sshd[10511]: Failed password for root from 183.3.202.104 port 64153 ssh2
Jan 22 13:43:08 servername sshd[10511]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 64153 ssh2]
Jan 22 13:43:18 servername sshd[10569]: Failed password for root from 183.3.202.104 port 33472 ssh2
Jan 22 13:43:23 servername sshd[10569]: message repeated 2 times: [ Failed password for root from 183.3.202.104 port 33472 ssh2]

When searching for non 183.3.202.104 IP addresses, the lines become:

$ cat auth.log | grep Failed | grep -v 183.3.202.104 | tail -n10
Jan 22 02:36:41 servername sshd[31074]: message repeated 5 times: [ Failed password for root from 221.203.142.71 port 33746 ssh2]
Jan 22 02:36:54 servername sshd[31388]: Failed password for root from 221.203.142.71 port 57792 ssh2
Jan 22 02:37:13 servername sshd[31388]: message repeated 5 times: [ Failed password for root from 221.203.142.71 port 57792 ssh2]
Jan 22 02:37:25 servername sshd[31698]: Failed password for root from 221.203.142.71 port 55440 ssh2
Jan 22 02:37:41 servername sshd[31698]: message repeated 5 times: [ Failed password for root from 221.203.142.71 port 55440 ssh2]
Jan 22 02:37:58 servername sshd[31918]: Failed password for root from 221.203.142.71 port 50225 ssh2
Jan 22 02:38:13 servername sshd[31918]: message repeated 5 times: [ Failed password for root from 221.203.142.71 port 50225 ssh2]
Jan 22 04:55:23 servername sshd[22179]: Failed password for invalid user support from 113.160.158.43 port 61614 ssh2
Jan 22 09:36:40 servername sshd[4160]: Failed password for invalid user a from 115.182.249.11 port 53046 ssh2
Jan 22 09:36:52 servername sshd[4204]: Failed password for invalid user oracle from 115.182.249.11 port 56673 ssh2

So first of all, I'd like to confirm that this is indeed an attack; I'm very unfamiliar with managing system security. Second, I'd like to know if there's any way to block all Chinese IP addresses; my server has so far been used solely in America and has nothing to do with China.

Answer 1

You can try Wizcraft's block list, and format it accordingly. At the time of my post, this blocklist was last updated on Thursday, 24-Dec-2015 11:01:52 MST. Keep in mind, Taiwan is not part of Mainland China, but that Hong Kong now belongs to, and is controlled by Beijing.

If you only use your server in America exclusively, you could use all of those rules to block attackers. If not, edit out the ones you don't want, and keep the ones you do.

Also keep in mind, this will not stop attackers from connecting to a VPN in a country of their choice, and once again attempting to login as root. This is merely a band-aid.

EDIT - BadSkillz and Jenny D have recommended fail2ban. This will probably be a better solution overall, but it probably wouldn't hurt to use both methods.

Answer 2

I also find it disturbing to see these low brow brute force login attempts and sadly yes they are mostly from China ( 'Vacuum cleaner' espionage ) - Good news is the solution is simple - only permit login to your server using SSH keys which then enables you to disable passwords as a login method

First create your secure SSH keys :

see doc for linux/OSX/Windows https://help.github.com/articles/generating-a-new-gpg-key/

in a terminal on your local box issue

ssh-keygen -t rsa -b 4096 -C "youremailaddr@example.com"

this will prompt you for a password (remember it) ... it will create a private and public key pair of files

private file  /home/mylogin/.ssh/id_rsa_supermoon
public file   /home/mylogin/.ssh/id_rsa_supermoon.pub

These files are now local to your machine ... just copy the public file onto your remote server and place into file (or append to)

/home/mylogin/.ssh/authorized_keys

assure it has proper file permissions on remote host

chmod 700 /home/mylogin/.ssh
chmod 600 /home/mylogin/.ssh/authorized_keys

Now back on your local host issue this to ssh login to your remote box

# only need to issue this set of 3 cmds once on same terminal
export REMOTE_IP=1.2.3.4 # your remote host IP
eval $(ssh-agent)
ssh-add ~/.ssh/id_rsa_supermoon  # enter same password as above

ssh mylogin@${REMOTE_IP}

* Start of Optional ------------ *

PS - sick of password prompts on every ssh then put this into your local ~/.bashrc

if [ ! -S ~/.ssh/ssh_auth_sock ]; then
  eval $(ssh-agent)
  ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
fi
export SSH_AUTH_SOCK=~/.ssh/ssh_auth_sock
ssh-add -l | grep "The agent has no identities" && ssh-add ~/.ssh/id_rsa_supermoon

------------ End of Optional

IMPORTANT - confirm you can correctly login using ssh ... ONLY then on your remote host edit the ssh config file

sudo vi /etc/ssh/sshd_config  
# PasswordAuthentication yes   # we do NOT want yes if ssh keys work
PasswordAuthentication no

to engage above config file change on remote host just bounce ssh server :

sudo service sshd restart  # (systemd ONLY) this does not kill your login session

Done - You will immediately see no more such brute login attempts since your remote host now summarily ignores password attempts and those guttersnipes will crawl away to pester someone else's unprotected server