Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to understand what I'm seeing in my SSH log file so that I can best defend against the bad guys. Particularly interested in understanding the number listed after "port" in the log. Here is a sample from my log file

Mar 30 00:05:16 server sshd[11067]: Failed password for root from 124.228.136.143 port 54381 ssh2
Mar 30 00:05:21 server sshd[11067]: Failed password for root from 124.228.136.143 port 54381 ssh2
Mar 30 01:00:53 server sshd[32193]: Accepted password for root from 192.168.3.3 port 50087 ssh2

I have changed my SSH to run on a non-standard port. The first two fail SSH attempts are from an unknown source (not any of my IP addresses), the third success is a login from me. However the number listed after "port" in the log is not the port number that SSH responds to on the server....so what is this number?

share|improve this question

4 Answers 4

up vote 3 down vote accepted

That's the port on the client's side. It'll be a random high number (less than 65535), and unrelated to the port that the server runs on.

share|improve this answer

As an aside, it is better to restrict root logins. Use a regular user and sudo or su to escalate privs.

share|improve this answer
    
Thanks, that was on the list of things to do...it's done now –  InvisibleFrisbee Mar 30 '11 at 15:50

It's the source port - the (random) port from which the connection is being initiated to your SSH listener.

share|improve this answer

Another good idea for ssh servers is to move the port to something other than 22 since it is scanned randomly all the time (this is what you're seeing). Other common ways to lock down ssh is use "allowed-hosts" functionality, implement "port knocking", and iptables scripting that will block sshd access for some length of time to IP addresses that have too many failed login attempts.

Last but certainly not least is use strong passwords and rotate them regularly.

share|improve this answer
    
I would consider strong passwords to be first, rather than last. Many of the other means are 'security through obscurity', which, in these days of fast computers and networks are a falsity. Every single port can be banner-scanned in a matter of seconds, which immediately blows away the 'port obfuscation' argument. Allowed host lockdown via either iptables or sshd itself is a good measure, as is the use of tools like fail2ban to eliminate brute force attacks. Finally, I would also suggest the use of keys+passwords rather than just passwords. –  gerryk Apr 1 '11 at 8:42
    
Gerry's points are well received though I think "certainly not least" makes its point well about using good passwords. There is nothing absolute about security and my opinion is that no one outside of an organization can know what methods are more/less important. My advice is simply what can be helpful but not on which ones may be more or less important. Keys+password absolutely...but not possible for automated processes. But, anything is better than rlogin and friends or telnet+expect! –  JGurtz Apr 4 '11 at 19:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.