Possible Duplicate:
Hundreds of failed ssh logins
Recently I have been spending more time on my production servers in efforts to puppetize several configs and I happened to issue a find /var/log -mmin1
and it returned the /var/log/secure
file (among others). Being curious as to recent activity being logged to this specific file, I started tailing it and several of these entries were being logged:
Jan 9 22:15:59 myhost sshd[22916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.213.48.82 user=apache
Jan 9 22:16:01 myhost sshd[22916]: Failed password for apache from 58.213.48.82 port 36464 ssh2
Jan 9 22:16:01 myhost sshd[22917]: Received disconnect from 58.213.48.82: 11: Bye Bye
Jan 9 22:16:03 myhost unix_chkpwd[22922]: password check failed for user (apache)
Jan 9 22:16:03 myhost sshd[22919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.213.48.82 user=apache
Jan 9 22:16:04 myhost sshd[22919]: Failed password for apache from 58.213.48.82 port 37392 ssh2
Jan 9 22:16:05 myhost sshd[22920]: Received disconnect from 58.213.48.82: 11: Bye Bye
Jan 9 22:16:06 myhost unix_chkpwd[22925]: password check failed for user (apache)
Jan 9 22:16:06 myhost sshd[22923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.213.48.82 user=apache
Jan 9 22:16:08 myhost sshd[22923]: Failed password for apache from 58.213.48.82 port 38244 ssh2
Jan 9 22:16:08 myhost sshd[22924]: Received disconnect from 58.213.48.82: 11: Bye Bye
Not too friendly looking, but I did notice that the requests were coming from the save IP address destined for varying local ports. So I did a whois 58.213.48.82
, and it returned this:
[Querying whois.apnic.net]
[whois.apnic.net]
% [whois.apnic.net node-4]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 58.208.0.0 - 58.223.255.255
netname: CHINANET-JS
descr: CHINANET jiangsu province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr: Beijing 100088
country: CN
admin-c: CH93-AP
tech-c: CJ186-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-CHINANET-JS
mnt-routes: MAINT-CHINANET-JS
....
This, again doesn't look friendly. So is this what a potential attack looks like? And how should I handle it? Setup an entry in IPTables to block any requests from the given IP?