2

I have 3 CentOS server configured for my applications. Recently I recognized that there is so many attacks to my servers. I have so many logs about attempt to login to my servers using sshd from unknown IPs.

This is some part of my secure log:

May 25 03:45:03 mail sshd[22291]: Invalid user user from 42.121.117.150
May 25 03:45:03 mail sshd[22303]: input_userauth_request: invalid user user
May 25 03:45:03 mail sshd[22291]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:03 mail sshd[22291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150 
May 25 03:45:03 mail sshd[22291]: pam_succeed_if(sshd:auth): error retrieving information about user user
May 25 03:45:05 mail sshd[22291]: Failed password for invalid user user from 42.121.117.150 port 59430 ssh2
May 25 03:45:05 mail sshd[22303]: Received disconnect from 42.121.117.150: 11: Bye Bye
May 25 03:45:07 mail sshd[22563]: Invalid user user from 42.121.117.150
May 25 03:45:07 mail sshd[22564]: input_userauth_request: invalid user user
May 25 03:45:07 mail sshd[22563]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:07 mail sshd[22563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150 
May 25 03:45:07 mail sshd[22563]: pam_succeed_if(sshd:auth): error retrieving information about user user
May 25 03:45:09 mail sshd[22563]: Failed password for invalid user user from 42.121.117.150 port 59655 ssh2
May 25 03:45:09 mail sshd[22564]: Received disconnect from 42.121.117.150: 11: Bye Bye
May 25 03:45:11 mail sshd[22565]: Invalid user user1 from 42.121.117.150
May 25 03:45:11 mail sshd[22566]: input_userauth_request: invalid user user1
May 25 03:45:11 mail sshd[22565]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:11 mail sshd[22565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150 
May 25 03:45:11 mail sshd[22565]: pam_succeed_if(sshd:auth): error retrieving information about user user1
May 25 03:45:13 mail sshd[22565]: Failed password for invalid user user1 from 42.121.117.150 port 59861 ssh2
May 25 03:45:13 mail sshd[22566]: Received disconnect from 42.121.117.150: 11: Bye Bye
May 25 03:45:15 mail sshd[22570]: Invalid user user from 42.121.117.150
May 25 03:45:15 mail sshd[22571]: input_userauth_request: invalid user user
May 25 03:45:15 mail sshd[22570]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:15 mail sshd[22570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150 
May 25 03:45:15 mail sshd[22570]: pam_succeed_if(sshd:auth): error retrieving information about user user
May 25 03:45:17 mail sshd[22570]: Failed password for invalid user user from 42.121.117.150 port 60107 ssh2

...

May 30 05:28:20 mail sshd[29998]: Failed password for root from 219.138.135.68 port 45105 ssh2
May 30 05:28:21 mail sshd[30273]: Failed password for root from 219.138.135.68 port 53227 ssh2
May 30 05:28:21 mail sshd[30266]: Failed password for root from 219.138.135.68 port 51786 ssh2
May 30 05:28:21 mail unix_chkpwd[30296]: password check failed for user (root)
May 30 05:28:21 mail unix_chkpwd[30297]: password check failed for user (root)
May 30 05:28:21 mail sshd[30280]: Failed password for root from 219.138.135.68 port 55313 ssh2
May 30 05:28:22 mail unix_chkpwd[30298]: password check failed for user (root)

...

May 31 11:12:38 mail sshd[2461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.233.60.37  user=root
May 31 11:12:40 mail sshd[2461]: Failed password for root from 211.233.60.37 port 48375 ssh2
May 31 11:12:40 mail sshd[2462]: Received disconnect from 211.233.60.37: 11: Bye Bye
May 31 11:12:45 mail unix_chkpwd[2671]: password check failed for user (root)
May 31 11:12:45 mail sshd[2669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.233.60.37  user=root
May 31 11:12:47 mail sshd[2669]: Failed password for root from 211.233.60.37 port 48619 ssh2
May 31 11:12:47 mail sshd[2670]: Received disconnect from 211.233.60.37: 11: Bye Bye
May 31 11:12:50 mail unix_chkpwd[2675]: password check failed for user (root)
May 31 11:12:50 mail sshd[2673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.233.60.37  user=root
May 31 11:12:52 mail sshd[2673]: Failed password for root from 211.233.60.37 port 48905 ssh2
May 31 11:12:53 mail sshd[2674]: Received disconnect from 211.233.60.37: 11: Bye Bye
...

How can I block this kind of attacks to my server? I have iptables installed on my server and all ports (except my needs) are rejected inside it.

  • Not aware of your network set-up but is there a need to have sshd open to public ? Is there any firewall involved ? – ciphercodes May 31 '14 at 13:43
3

I would install sshguard on this server to automatically block hosts trying to bruteforce your ssh accounts. It does this by adding the offending hosts to the firewall rules.

An alternative to this is denyhosts which do more or less the same as sshguard, but uses /etc/hosts.deny instead of firewall rules to block the offenders.

3

In addition to @DogEatCatWorld's answer, there is a more general piece of software called 'fail2ban' that can be configured to monitor log files for specific regular expressions and track IP addresses that act 'suspiciously' (for instance, multiple failed ssh login attempts within a certain timespan) and temporarily block the IP address at the firewall level.

It comes with a number of default rulesets for most common daemons and is almost infinitely tweakable if you want.

1

You could (should ?) also :

  • disable ssh root login (You can still use sudo to do system administration)
  • Disable password authentication and enable key authentication

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.