3

For the past few months I regularly see alerts on my Synology about SSH connection being blocked. Somebody (here a nice Chinese guy from 222.186.15.158) was attempting to connect to my NAS with the root account (Fortunately PermitRootLogin is disabled).

What I am a bit worried because if I see a public address here, it means my NAS is somehow reachable from the internet. However all ports are closed on my front router, NAT is disabled, DMZ is disabled.

When I try to nmap my router from the outside I get this : 

$ nmap -Pn -p- x.x.x.x

Starting Nmap 7.60 ( https://nmap.org ) at 2020-05-17 01:07 CEST
Nmap scan report for x.x.x.x
Host is up (0.012s latency).
Not shown: 997 filtered ports
PORT     STATE  SERVICE
113/tcp  closed ident
2000/tcp open   cisco-sccp
5060/tcp open   sip

Nmap done: 1 IP address (1 host up) scanned in 8.23 seconds

So there is no SSH entry point.

How would it be technically possible to see a public IPv4 address attempting to connect to my LAN NAS?

From the Synology DSM I exported the last log entries from the Log Center. 

System
Level,Log,Date & Time,User,Event,
Warning,System,2020/05/16 21:34:44,SYSTEM,Host [222.186.15.158] was blocked via [SSH].
Warning,System,2020/05/04 07:46:14,SYSTEM,Host [222.186.30.59] was blocked via [SSH].
Warning,System,2020/04/15 06:46:01,SYSTEM,Host [51.91.158.54] was blocked via [SSH].
Warning,System,2020/04/13 17:46:00,SYSTEM,Host [27.78.14.83] was blocked via [SSH].
Warning,System,2020/04/13 17:45:55,SYSTEM,Host [116.105.216.179] was blocked via [SSH].
Warning,System,2020/04/12 17:46:52,SYSTEM,Host [86.36.20.20] was blocked via [SSH].

This log is an SQLITE database directly connected to syslog-ng.

My router is a Salt Fiber Box from my internet provider. The interface is very primitive. Even the Expert mode gives no transparency about the Firewall features. I don't even know what Medium means in this case:

enter image description here enter image description here enter image description here

Some thoughts

From symcbean comment three scenarios are possible:

  • Something is already inside my network.
    • Then I would probably see attacks from local addresses it is stupid to give me the information of what is the IP of my attacker.
  • My router is compromised.
    • Unfortunately this options is conceivable
  • There is an issue with the information I gave.
    • As I said, no NAT/DMZ options are enabled on my router (screenshots attached)
    • The Synology has no DDNS configured, no tunnels, no VPN

From mti2935 comment

  • The router could be compromised, the attacker could have punched a hole for himself only accessible from his own IP (or range of IPs).
    • In this case I would expect this attacker to do a more massive attack, not few attempts every few weeks.
Improve this question
19
  • 1
    Can you post relevant log entries ? You could run netstat on the Synology to see if there is network activty you are not aware of.
    – Kate
    May 17, 2020 at 12:22
  • 1
    Not familiar with this device but it should be Linux-like. Is there a /var/log directory and maybe an auth.log file in that directory ?
    – Kate
    May 17, 2020 at 13:08
  • 1
    If all the information you have provided is accurate, and the default route on the NAS box is the router you describe above then either someone else is already inside your network (unlikely) or your router is compromised. However I suspect that that there may be an issue with some of the information you have presented here.
    – symcbean
    May 17, 2020 at 14:51
  • 1
    The logs that you posted are what I was looking for. These indeed seem to show connections from outside/remote ip's, as you said. Moreover, if you google the remote all ip's, all of them are on various abuse lists for brute-force SSH attacks. This could be bot-net activity. The question is, how are they traversing your router. Can you try using a few of the open port checking tools online (such as portcheckers.com, canyouseeme.org, etc) to test port 22 on your public ip, to see if you get a different result than you got with your nmap scans?
    – mti2935
    May 17, 2020 at 23:33
  • 1
    This is a real head-scratcher. It's a mystery as to how the attackers are seemingly able to traverse your router and make ssh connection attempts to the NAS on your inside LAN from their outside IP, while you are unable to repeat this despite all of your attempts from multiple IP's. Notwithstanding, if I was in your shoes, I would no longer trust your ISP-provided router. You might want to consider running the ISP-provided router in bridge mode, and using a separate hardware firewall (that you have more control over) directly behind it.
    – mti2935
    May 18, 2020 at 17:08

1 Answer 1

Reset to default
1

I might found the culprit, at least in my case, rsync. I use rsync on my NAS and that port is open, has port redirection on my router and guess what it uses SSH, so that would explain why my NAS gives me those same SSH warnings eventhought SSH is turned off on my Synology.

Have had no more logs about bruteforce attempts on SSH sofar since I closed the port today.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .