0

On one of my servers I run ssh on non-standard port, but still it was discovered by some botnet which is now trying to connect to my server (and, I believe, it scans Internet looking for ssh-enabled servers). I use DenyHost, so their IPs are banned with netfilter and I also use keys instead of passwords so they probably do not have a chance, but my daily report is full of:

Failed logins from:
5.2.182.5 (static-5-2-182-5.rdsnet.ro): 1 time
5.135.140.175 (ns2312134.ovh.net): 1 time
31.131.250.186 (rg1.rivegauche.ru): 1 time
34.232.136.66 (ec2-34-232-136-66.compute-1.amazonaws.com): 1 time
...

I have 44 records today.

As a "good guy" what should I do about it? I can fetch abuse emails and write them i.e.:

$ whois 31.131.250.186
...
% Abuse contact for '31.131.248.0 - 31.131.255.255' is '[email protected]'

but is it worth doing? Will it help?

2
  • 1
    Generally, the answer is "no" because it's not worth your time. Normally this traffic comes from hosts that just aren't going to respond to an abuse email. You might consider it if the traffic is coming from someone you suspect might do something about it. But odds are if it's coming from Russia, China, etc, you'll get nothing, and you should just ignore it. Apr 26, 2018 at 21:14
  • 1
    Also, scanning is so normalized today that EVERYONE is essentially commonly being scanned. Also consider there are legitimate scans needed for security purposes, so scans aren't black/white as you're thiniking. Apr 26, 2018 at 21:18

1 Answer 1

1

You could try to use ipset and just drop everything:

ipset create BlockTheRussians hash:ip

Next

ipset add BlockTheRussians <IP Address>  <-- Repeat for each IP

Finally

iptables -I INPUT -m set --match-set BlockTheRussians src -j DROP

Another thing worth installing is Fail2Ban.

1
  • Thank you. I use DenyHost that adds -j DROP for any IP that tried to login several times and failed to do so. It should be close to what Fail2Ban does.
    – user996142
    Apr 26, 2018 at 22:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .