34

I've seen something like:

sshd[***]: Invalid user oracle from **.**.**.**                          // 1st line
sshd[***]: input_userauth_request: invalid user oracle [preauth]         // 2nd line
sshd[***]: Received disconnect from **.**.**.**: 11: Bye Bye [preauth]   // 3rd line

and I know that's someone tries to log into my server, but what does it mean when there's only the 3rd line repeating over and over again for, like, 3000+ times?

I mean, like this (there's no Invalid user or input_userauth_request):

sshd[***]: Received disconnect from **.**.**.**: 11: Bye Bye [preauth]
sshd[***]: Received disconnect from **.**.**.**: 11: Bye Bye [preauth]
sshd[***]: Received disconnect from **.**.**.**: 11: Bye Bye [preauth]

What's the purpose of doing so, what's he trying to do since it's "disconnect" instead of trying to login?

Improve this question

2 Answers 2

Reset to default
26

This error rises from a fatal error in the authentication process (see monitor.c of OpenSSH versions 6.1p1+).

It is likely that the attacker is using some custom code to brute-force the server which is ending up in malformed authentication requests being sent, resulting in the server killing the connection. So from the code it appears they are in fact trying to login, but the server doesn't like how they're attempting that.

As such, these log entries aren't anything to worry about unless you think you are likely to be a targeted victim for any reason (in which case you should be taking extra precautions such as refusing password-based logins).

In any case, I suggest you install the simple fail2ban program if you haven't already which will significantly hinder cookie-cutter brute-force authentication attempts.

Improve this answer
9
  • 1
    Thx. So, since I'm using fail2ban and using SSH key only, my server is safe, right? ;)
    – iceX
    Oct 22, 2013 at 12:38
  • Over what period of time are you getting these 3,000+ log entries? Worth investigating that fail2ban is working effectively. There is a delay before it acts but it's possible it doesn't regard this specific log-line as an issue, if it's not just incorrectly setup.
    – deed02392
    Oct 22, 2013 at 12:50
  • 1
    fail2ban is up and running, and the reason those entries appeared in the log is because the default fail2ban rules just ignored them and took no action( yes I think you are right that it doesn't regard this specific log-line as an issue). I added some regex to sshd-ddos.conf and now, the log looks fine. :)
    – iceX
    Oct 22, 2013 at 13:41
  • Still, felt a bit weird that since the default fail2ban rule doesn't regard this as an issue, then those attempts should be not so dangerous...then...what's the point of doing this kind of attack...
    – iceX
    Oct 22, 2013 at 13:45
  • 1
    My gut feeling is the authors of the provided rules expected the associated log entries that you mentioned and so only included those. Re the point of this attack, I do think that the attack is not effective and it's a flaw in their attack versus your specific SSH server, making it effective only as a possible DoS rather than a risk of compromise. It might be an idea to enable debug logging and watch it for a few days to see if the same attack is launched, then spot what specifically they're trying although I can't guarantee even debug logging would capture anything interesting.
    – deed02392
    Oct 22, 2013 at 14:03
1

I use a laptop (running linux) somtimes with a 3G dongle (directly connected to the internet) and I get hundreds of these:

Oct 21 10:11:52 c4111um sshd[8912]: Failed password for invalid user hash from 203.195.182.30 port 36789 ssh2
Oct 21 10:11:53 c4111um sshd[8912]: Received disconnect from 203.195.182.30: 11: Bye Bye [preauth]
Oct 21 10:11:56 c4111um sshd[8914]: Invalid user admin from 203.195.182.30
Oct 21 10:11:56 c4111um sshd[8914]: input_userauth_request: invalid user admin [preauth]
Oct 21 10:11:56 c4111um sshd[8914]: pam_unix(sshd:auth): check pass; user unknown
Oct 21 10:11:56 c4111um sshd[8914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.195.182.3

http://www.infobyip.com/ip-203.195.182.30.html (usually originates from our chums in China)

Improve this answer
1
  • yeah, the IP that i'm talking about is from China also :(
    – iceX
    Oct 26, 2013 at 2:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .