I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu machine). Fail2ban is blocking these IPs but I do not understand how they are coming to my VM.

What can be happening?

PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=  user=root
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost= 

Failed password for root from port 60579 ssh2
message repeated 2 times: [ Failed password for root from port 60579 ssh2]
  • 1
    Just on a quick side note. SSH should be running its privileged port 22. Changing the port reduces the amount of log entries, but is more dangerous. Here's a full article explaining it: adayinthelifeof.nl/2012/03/12/…
    – Potaito
    Jul 7 '16 at 16:08
  • @potAito I disagree. if you are using SSH keys (which you should be using anyway) this attack will have no effect since there is no password to steal. Aug 6 '16 at 16:07
  • Are you sure you have a network security group set up with rules to block inbound ssh and that network security group is assigned to your vm? On the nsg resource you can click "effective security rules" to check the ruleset, and on your vm network settings you can check the assigned nsg. And I just realized this is a months old question. Will still leave my comment here. :) Dec 5 '16 at 0:28
  • @GaborLengyel Thank you for your answer, since a few months ago robots are not getting to my VM's and I didn't changed security configurations in Azure.
    – jdmorei
    Jan 13 '17 at 12:08

No need to worry, these are just typical attempts to find vulnerable servers. You've Fail2Ban already installed, this way you decrease the brute force attempts.

  • Change your default ssh port too, it will reduce the attempts.
    – ThoriumBR
    Jun 7 '16 at 13:38
  • Thank you !! I don't understand if I can't doing login, I can't began tcp handshake because SSH in Azure is closed, how can they doing this?
    – jdmorei
    Jun 7 '16 at 14:38
  • Can you access port 22/tcp yourself?
    – ndrix
    Jun 7 '16 at 22:41
  • Hi M1ke, I can't access throw Internet. I access throw a VPN. This is the problem, I don't understand nothing :S
    – jdmorei
    Jun 8 '16 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.