Two days ago I built a Debian 10 server in the United States for use as a file server for my web application. When I created the server, I installed the
fail2ban package and configured a basic, minimal firewall using the following rules:
*filter # Allow all loopback (lo0) traffic and reject traffic # to localhost that does not originate from lo0. -A INPUT -i lo -j ACCEPT -A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT # Allow ping. -A INPUT -p icmp -m state --state NEW --icmp-type 8 -j ACCEPT # Allow SSH connections. -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT # Allow inbound traffic from established connections. # This includes ICMP error returns. -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Log what was incoming but denied (optional but useful). -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables_INPUT_denied: " --log-level 7 # Reject all other inbound. -A INPUT -j REJECT # Log any traffic which was sent to you # for forwarding (optional but useful). -A FORWARD -m limit --limit 5/min -j LOG --log-prefix "iptables_FORWARD_denied: " --log-level 7 # Reject all traffic forwarding. -A FORWARD -j REJECT COMMIT
Today when I checked my firewall, I found the following:
Chain INPUT (policy ACCEPT) target prot opt source destination f2b-sshd tcp -- anywhere anywhere multiport dports ssh ACCEPT all -- anywhere anywhere REJECT all -- 127.0.0.0/8 anywhere reject-with icmp-port-unreachable ACCEPT icmp -- anywhere anywhere state NEW icmp echo-request ACCEPT tcp -- anywhere anywhere tcp dpt:ssh state NEW ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED LOG all -- anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables_INPUT_denied: " REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain FORWARD (policy ACCEPT) target prot opt source destination LOG all -- anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables_FORWARD_denied: " REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain f2b-sshd (1 references) target prot opt source destination REJECT all -- 18.104.22.168 anywhere reject-with icmp-port-unreachable RETURN all -- anywhere anywhere
There are only two user accounts on the server, the root account and a personal account for myself. I'm not a firewall expert but the
Chain f2b-sshd entry looks suspicious to me:
When I run
whois on that IP address, I see that it originated somewhere in China.
I have other production servers that have been running for over a year that are built on Debian 9 and I've never seen entries like this ever.
- Does this entry indicate that someone at that IP address has tried to break into my server?
- If the answer is "yes", is Debian 10 now recording all break-in attempts with entries like this?
- Are there additional steps I should take to secure my server?