I've have had an Ubuntu 8.04 server running and on the Internet for a few days....I have Ports 21 and 22 open for FTP and SSH...All other ports are closed.
And found this
Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp6 0 68 10.7.1.71%134645824:ssh 220.127.116.11%8:47777 ESTABLISHED
It appears as if 18.104.22.168 has established an SSH connection to the server...and is sending packets out... Is it possible for someone to establish an SSH connection without authenticating?
I did Reverse DNS lookups on the address...and it seems to oringnate from China according to this resource...
I assume most servers are fending off stuff like this all the time, but is it unusual to have someone sit on a port like this? And is there an way to block certain IP's at the server level?
The server is sitting behind a substantial Cisco firewall ..