1

Got around 60 failed Login attemps today. And there are more and more.

So yeah, Server is secured with an 4096-Bit SSH-Key (with passphrase). The Server has Fail2ban installed, and Root login disabled.

Oct 23 23:42:30 **** sshd[9726]: Received disconnect from ***: 11:  [preauth]

Oct 24 17:15:13 *** sshd[10386]: Bad protocol version identification '\026\003\001' from **** port 34017

Oct 24 03:57:30 * sshd[9929]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Oct 24 03:57:32 * sshd[9929]: Failed password for root from * port 58904 ssh2
Oct 24 03:57:32 * unix_chkpwd[9932]: password check failed for user (root)

Oct 24 03:57:35 ** sshd[9929]: PAM 1 more authentication failure; logname                                                                              = uid=0 euid=0 tty=ssh ruser= rhost=*  user=root

Oct 23 14:59:16 * sshd[9389]: reverse mapping checking getaddrinfo for s                                                                              aargo.com.mx [*] failed - POSSIBLE BREAK-IN ATTEMPT!

vps330608 sshd[8993]: Received disconnect from **: 11: Bye Bye [preauth]
vps330608 sshd[10393]: Received disconnect from **: 11: Closed due to user request. [preauth]

The Brute-Force Attack is still running... Over 400 Lines at /var/log/secure Fail2Ban still banning Ip-Adresses. Most of IP's are from Italy / France. Server located in France.

Any worries?

Regards

1

Any worries?

Well, It can be. Depends on how open the IP of the server is for ssh logins. Is it available for the whole internet?

If yes it is highly vulnerable to attacks, It can be an easy victim of DDoS(or even DoS) attack. As port 22 to this IP(which is public) is open, Anybody can reach you with spoofed or even non spoofed sources.

The Server has Fail2ban installed, and Root login disabled.

fail2ban only checks for wrong passwords, retries et al. So any body can send a flood of SYN packets to your IP and your server may get overwhelmed with those SYNs and sending them SYN/ACKs back to non-existent sources.

Some easy solutions would be:

  • Block them early in your network, Block them using a firewall or an inline device which can block requests from unwanted sources.
  • Use IPtables, Block(drop, do not reject) them using IPtables on your server itself.
  • If its used inside your network only bring it on a private IP

Hope this helps!

  • The Server ist mostly used as an OpenVPN Server with an MySQL Database. Most of Ports are closed (80,8080). Also only the SSH-Port, and the OpenVPN. And yes, the Server is available for the whole Internet. – Meerbi Oct 24 '16 at 17:26
  • Why open ssh too from internet?, Also consider rate-limiting certain traffic using IPtables using the flag --limit-burst. Please mark answer helpful or answered if it answered your question. Thanks! – Anirudh Malhotra Oct 24 '16 at 17:42
1

I've been seeing daily ssh login probes of the kind you describe on all of the servers which have a public-facing ssh service running on the standard ssh port for as long as I've had servers online (>10 years). Is what you're seeing really exceptional traffic for your server, or is it just "internet background radiation"?

I've just learned to live with the fact that a server that's visible on the internet will draw a certain amount of malicious traffic every day; it's the same with running a web server and watching strange requests that are designed to exploit some php weakness come in, even if php is not installed. Up to now they haven't eaten enough bandwith to make me care much.

In addition to Anriduh's easy solutions, here's probably the easiest - I noticed that you can get rid of a huge number of automated ssh probes by just switching your ssh service away from the default port to some nonstandard port. This doesn't help, of course, if you're dealing with a DoS-attack, but most likely you're not (you'd get hundreds of thousands of connection attempts, not just a few hundred). Changing the default port has the additional advantage of filtering breakin attempts by determination; if someone takes the time to actually portscan your machine to find your ssh service, instead of blindly trying to connect to port 22, you can assume the breakin attempt is a bit more serious.

Make sure your ssh server is always up to date, that's probably the single most important security measure you can take to avoid trouble.

  • Thanks, I'm not the only OpenVPN-User on this Server. I'm having an Load-Balancer running too. So the Server is in an Private Network with around 20 other Server's from different locations and the MySQL Database (For the OpenVPN Passwords and some other stuff). i configured the Load-Balancer so, that there's an percentage (also Server1 = 16.6%, Server2 = 6.66%......). I'm only having the issue with this Server. And thats an bit strange... DoS-Attacks are not that Hard. The Server has an 40GB/s Inbound (Shared) and an 10Gb/s Outbound. – Meerbi Oct 24 '16 at 19:22
  • An simple Portchange, and i'm good to go. I will reconfigure my IPtables too. – Meerbi Oct 24 '16 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.