We had been testing an AWS instance accessing an internal Ubuntu 10.04.3 server, so had modified our firewall to allow all ports from that specific IP address to the server. We then released the AWS instance but forgot to remove the firewall rule.
Yesterday, someone noticed failed login attempts in auth.log which were coming from various China and Korea locations (according to whois.sc). So we removed the firewall rule, and the login attempts stopped.
Here's a section of auth.log showing a failed login attempt:
Feb 23 12:33:15 TestServer1 sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.104.22.168 user=root Feb 23 12:33:15 TestServer1 sshd: pam_winbind(sshd:auth): getting password (0x00000388) Feb 23 12:33:15 TestServer1 sshd: pam_winbind(sshd:auth): pam_get_item returned a password Feb 23 12:33:15 TestServer1 sshd: pam_winbind(sshd:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_USER_UNKNOWN (10), NTSTATUS: NT_STATUS_NO_SUCH_USER, Error message was: No such user Feb 23 12:33:17 TestServer1 sshd: Failed password for root from 22.214.171.124 port 2539 ssh2
Obviously, since the firewall rule was still in place for the AWS instance, it was letting traffic through for that IP, but I'm wondering how the external IP 126.96.36.199 was getting access to our internal server. Is that possibly a spoofed IP, and not the real originator? If that's true, doesn't it mean that Amazon allows spoofed packets on their network?
I'm not the network configuration guy here, and am wondering for my own benefit, so please excuse me if this is a noob question.