Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently, I opened up the SSH port through my firewalls (and redirecting to my server) so I could check on the (http) server while on the road. The first week or two there was nothing different. But now, three or four weeks later, I see lots of this:

Mar 20 08:38:28 localhost sshd[21895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.queued.net  user=root
Mar 20 08:38:31 localhost sshd[21895]: Failed password for root from 207.210.101.209 port 2854 ssh2
Mar 20 15:38:31 localhost sshd[21896]: Received disconnect from 207.210.101.209: 11: Bye Bye
Mar 20 08:38:32 localhost unix_chkpwd[21900]: password check failed for user (root)
Mar 20 08:38:32 localhost sshd[21898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.queued.net  user=root
Mar 20 08:38:34 localhost sshd[21898]: Failed password for root from 207.210.101.209 port 3729 ssh2
Mar 20 15:38:35 localhost sshd[21899]: Received disconnect from 207.210.101.209: 11: Bye Bye
Mar 20 08:38:36 localhost unix_chkpwd[21903]: password check failed for user (root)
Mar 20 08:38:36 localhost sshd[21901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.queued.net  user=root
Mar 20 08:38:38 localhost sshd[21901]: Failed password for root from 207.210.101.209 port 4313 ssh2
Mar 20 15:38:38 localhost sshd[21902]: Received disconnect from 207.210.101.209: 11: Bye Bye
Mar 20 08:38:40 localhost unix_chkpwd[21906]: password check failed for user (root)
Mar 20 08:38:40 localhost sshd[21904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.queued.net  user=root
Mar 20 08:38:42 localhost sshd[21904]: Failed password for root from 207.210.101.209 port 4869 ssh2
Mar 20 15:38:43 localhost sshd[21905]: Received disconnect from 207.210.101.209: 11: Bye Bye
Mar 20 08:38:44 localhost unix_chkpwd[21909]: password check failed for user (root)
Mar 20 08:38:44 localhost sshd[21907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.queued.net  user=root
Mar 20 08:38:46 localhost sshd[21907]: Failed password for root from 207.210.101.209 port 2512 ssh2
Mar 20 15:38:47 localhost sshd[21908]: Received disconnect from 207.210.101.209: 11: Bye Bye
Mar 20 15:38:57 localhost sshd[21912]: Connection closed by 207.210.101.209

There are about 1100 lines of these for March 20th, zero for the 19th, and 800 or so for the 18th—all related to the same IP.

What does it mean? What should I do? Why isn't it chronological?

share|improve this question
    
I had the same thing too, just curious, anything anomalous in the apache logs? try searching for lines with phpinfo() in them –  Journeyman Geek Mar 21 '10 at 7:34
1  
2k attempts from the same IP during 3 days is rude and lame. Consider to mail the network owner (you can find the abuse email by doing whois against the offending IP) and complain. Also include a log snippet. Adequate network owners are very harsh towards such malicious actions that get linked to them. –  Anonymous Mar 21 '10 at 16:05
    
I agree: Rude, lame, and annoying. There's no chance of success: root login is disabled from outside. I'll pursue the abuse lead given by whois toolserver.org/~chm/whois.php?ip=207.210.101.209 –  wallyk Mar 21 '10 at 19:55
    
@Journeyman geek: no, there's no activity in the apache logs which shouldn't be there. The http port is mapped from like 58765 on the outer firewall, and only specific virtual hostnames are responded to. It is odd that I have http more secure than ssh, but when I set that up nearly a year ago, I didn't trust the php-based access controls in the application. I do now, so I guess I could make it more straightforward. –  wallyk Mar 22 '10 at 6:41
add comment

3 Answers

up vote 3 down vote accepted

These are script kiddie attempts to get root via ssh on your box. The best way i've found to deal with these is:

  1. change the ssh port to anything but 22 (say 32999) or another random high port number
  2. use fail2ban or similar script. After a few failed login attempts it bans the ip with iptables for a specific period of time.

There will be newbies chiming in on how setting the port to a different number is security through obscurity. Yes and no. It doesn't make your box any more secure but it will drastically cut down on the number of scripted attempts to crack ssh.

Edit:

Other good things to do are, disable root logins just in case they did guess your root password or disable password authentication altogether and use key based authentication.

share|improve this answer
    
Agreed on 99% of your answer - but isn't using a high port dangerous? Note that non-privileged users can start services on ports >= 1024. So if your SSH server dies, you may log into a user's service instead of your machine. (This could also happen, if someone hacks e.g. your Apache, even though it runs as www-data) –  Chris Lercher Mar 21 '10 at 17:02
    
[It should be noted, that it's less dangerous in this case, since SSH is encrypted, but I still have a bad feeling about it] –  Chris Lercher Mar 21 '10 at 17:07
    
Altering the port seems reasonable to conserve bandwidth, but will I have trouble with lame ssh clients not being able to specify or work successfully? Root login is not permitted from outside, so I'm not too worried about them finding the only two account names which are enabled. And they have 12+ character passwords. Well—not words, but character strings. –  wallyk Mar 21 '10 at 19:57
    
It is security through obscurity. Changing a port is not securing anything nor is it a best practice. Filtering incoming traffic and implementing a strong password policy would be a better solution. –  Warner Mar 22 '10 at 14:46
    
If you actually read my comment you'll notice i didn't say changing the port secures anything. It does however drastically reduce the number of scripted attempts at ssh. If you have 50,000 login attempts a month compared to zero it does make a difference. It's not the be all end all solution and that's why listed it as just one out of a number of things that could be done. Others being fail2ban which filters incoming traffic and key based authentication. It might not be a "best practice" in your book but it's a real world practice in mine and countless other admins. –  anonymouse Mar 22 '10 at 16:42
add comment

A technique called port knocking can be used that allows you to keep your ssh port closed until requested (externally) by you.

share|improve this answer
    
Very interesting... and tempting. Alas, I don't think my Motorola Wimax modem will make this easy. Having a daemon check the modem log will encounter all kinds of complexity having to go through a password-protected html interface. I wouldn't be surprised if there's a solution for that, though the slowly changing passwords might be an issue. –  wallyk Mar 21 '10 at 20:11
    
You might consider leaving the port in the modem open and mapped only to the private IP of the server, but have it closed on the server and do the port knocking there using the server's logs. Or something to that effect. –  Dennis Williamson Mar 21 '10 at 20:46
add comment

Above answers explain why you're getting many authentication attempts to your SSH server.

As to "Why isn't it chronological?", it looks like you may have a problem with your time zone setting. All the logs seem to be sequential, just at different hours (the minutes and seconds line up).

Try running:

sudo dpkg-reconfigure tzdata

share|improve this answer
    
I don't have any other issues with timekeeping. All the other logs show strict monotonic increasing timestamps. It's almost like a ssh connection opens and then closes 7 hours later, and then all of that session is logged at once. (Could that be?) –  wallyk Mar 21 '10 at 20:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.