this is the situation:
- vps with debian 8x32 virgin (new template of the provider's repository);
- exotic "user" and strong "password" ;
- 30 seconds later: command (apt-get update);
30 seconds later: command (netstat);
netstat show :
- 1 x tcp established sshd connection (my remote ssh client);
- 1 x tcp sshd connection ESTABLISHED (Chinese ip) (small heart attack);
30 seconds later: command (cat /var/log.auth/);
- log contains:
- only my remote connection "Accepted";
several attempts to connect invalid (ssh brute force);
30 seconds later:
- installed fail2ban for ssh and 4 more services;
- configured permanent ban (value -1);
populated hosts.deny with some ip that are attacking;
2 days later: * log revision var / log / auth * | grep [Accepted, invalid, refused, etc];
Everything indicates that no attack has been successful; The ips hosts.deny are ejected perfectly; Fail2ban works perfectly; The attacks by only ip have diminished; Now the logs only show attacks by only ip and not 200 attacks by ip; All the "Accepted" connections of the logs are correct (only I with my remote client have been successful in connecting, apparently);
I know the first thing is to deactivate root, passwords, etc. and use public key and other things, but my question refers to the "ESTABLISHED" status of an SSH connection shown by netstat, that is:
Is it possible that a result of netstat ESTABLISHED has been assumed but has not been produced?
Does a result of ESTABLISHED nestat definitely and definitely indicate that the machine has been compromised?
Is it possible that the attacker is playing with modified SYN or SYN-ACK to simulate a fake STABLISHED connection?
Extra: I have seen ESTABLISHED connections 4 times just after being banned permanently by fail2ban and after 2 seconds re-firing netstat and seeing how nonexion vanished like a ninja;
Thanks in advance.