7

I have been seeing persistent SSH connection attempts on my computer from a familiar IP address. I got curious and decided to do some Googling on the IP address. Turns out that someone from Indonesia is publicly sharing a whole list of IP addresses of servers, some from Digital Ocean, with their SSH passwords. I am not sure whether these servers belong to that person, whether these are admin passwords and what is the purpose of the person sharing it publicly. But it does look shady since I am getting SSH login attempts from one of those IPs. Are these SSH passwords of hacked servers? Why is the person sharing it? What can be done about it?

1

I'm seeing the posted link and it seems to be an Indonesian facebook page, where the group writes IPs and credentials of different servers. I think so these servers don't belong to the group, but the group itself discovers them by sharing their credentials. I don't know what they do with them, but then the servers are most likely hacked for some purpose. Similar attacks are performed by brute forcing an SSH connection through specific tool (Hydra, Medusa, ...), as you are seeing in your computer. So, it is very important to have a strong SSH password (alphanumerics>=10), to define a specific user for the SSH connection, and to disable the root/admin account for SSH logins. You can find a lot of posts on how to protect a SSH server:

http://www.tecmint.com/5-best-practices-to-secure-and-protect-ssh-server/

Unfortunately it's common to find out similar group of crackers (pay attention, not hacker), but it's the first time I see a clear fb page.

  • 5
    "it is very important to have a strong SSH password": or to disable password authentication altogether in SSH config and allow only public key authentication. – WhiteWinterWolf Feb 9 '15 at 10:21
  • 1
    Or you can just use fail2ban and configure it to ban everybody who enters the pass wrong more than N times. I've configured it to drop all connections from the banned IP for a day or two and so far (3 years) I haven't had any problems. But using auth keys is also a very good idea, since most bots are mainly brute-forcing for a normal pass. – tftd Feb 16 '15 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.