0

On one of my servers I run ssh on non-standard port, but still it was discovered by some botnet which is now trying to connect to my server (and, I believe, it scans Internet looking for ssh-enabled servers). I use DenyHost, so their IPs are banned with netfilter and I also use keys instead of passwords so they probably do not have a chance, but my daily report is full of:

Failed logins from:
5.2.182.5 (static-5-2-182-5.rdsnet.ro): 1 time
5.135.140.175 (ns2312134.ovh.net): 1 time
31.131.250.186 (rg1.rivegauche.ru): 1 time
34.232.136.66 (ec2-34-232-136-66.compute-1.amazonaws.com): 1 time
...

I have 44 records today.

As a "good guy" what should I do about it? I can fetch abuse emails and write them i.e.:

$ whois 31.131.250.186
...
% Abuse contact for '31.131.248.0 - 31.131.255.255' is 'abuse@selectel.ru'

but is it worth doing? Will it help?

  • 1
    Generally, the answer is "no" because it's not worth your time. Normally this traffic comes from hosts that just aren't going to respond to an abuse email. You might consider it if the traffic is coming from someone you suspect might do something about it. But odds are if it's coming from Russia, China, etc, you'll get nothing, and you should just ignore it. – Steve Sether Apr 26 '18 at 21:14
  • 1
    Also, scanning is so normalized today that EVERYONE is essentially commonly being scanned. Also consider there are legitimate scans needed for security purposes, so scans aren't black/white as you're thiniking. – Steve Sether Apr 26 '18 at 21:18
1

You could try to use ipset and just drop everything:

ipset create BlockTheRussians hash:ip

Next

ipset add BlockTheRussians <IP Address>  <-- Repeat for each IP

Finally

iptables -I INPUT -m set --match-set BlockTheRussians src -j DROP

Another thing worth installing is Fail2Ban.

  • Thank you. I use DenyHost that adds -j DROP for any IP that tried to login several times and failed to do so. It should be close to what Fail2Ban does. – user996142 Apr 26 '18 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.