up vote 1 down vote favorite
share [g+] share [fb]

I'm trying to understand what I'm seeing in my SSH log file so that I can best defend against the bad guys. Particularly interested in understanding the number listed after "port" in the log. Here is a sample from my log file

Mar 30 00:05:16 server sshd[11067]: Failed password for root from 124.228.136.143 port 54381 ssh2
Mar 30 00:05:21 server sshd[11067]: Failed password for root from 124.228.136.143 port 54381 ssh2
Mar 30 01:00:53 server sshd[32193]: Accepted password for root from 192.168.3.3 port 50087 ssh2

I have changed my SSH to run on a non-standard port. The first two fail SSH attempts are from an unknown source (not any of my IP addresses), the third success is a login from me. However the number listed after "port" in the log is not the port number that SSH responds to on the server....so what is this number?

link|improve this question
25% accept rate
feedback

4 Answers

up vote 3 down vote accepted

That's the port on the client's side. It'll be a random high number (less than 65535), and unrelated to the port that the server runs on.

link|improve this answer
feedback
up vote 2 down vote

As an aside, it is better to restrict root logins. Use a regular user and sudo or su to escalate privs.

link|improve this answer
Thanks, that was on the list of things to do...it's done now – InvisibleFrisbee Mar 30 '11 at 15:50
feedback
up vote 1 down vote

It's the source port - the (random) port from which the connection is being initiated to your SSH listener.

link|improve this answer
feedback
up vote 0 down vote

Another good idea for ssh servers is to move the port to something other than 22 since it is scanned randomly all the time (this is what you're seeing). Other common ways to lock down ssh is use "allowed-hosts" functionality, implement "port knocking", and iptables scripting that will block sshd access for some length of time to IP addresses that have too many failed login attempts.

Last but certainly not least is use strong passwords and rotate them regularly.

link|improve this answer
I would consider strong passwords to be first, rather than last. Many of the other means are 'security through obscurity', which, in these days of fast computers and networks are a falsity. Every single port can be banner-scanned in a matter of seconds, which immediately blows away the 'port obfuscation' argument. Allowed host lockdown via either iptables or sshd itself is a good measure, as is the use of tools like fail2ban to eliminate brute force attacks. Finally, I would also suggest the use of keys+passwords rather than just passwords. – gerryk Apr 1 '11 at 8:42
Gerry's points are well received though I think "certainly not least" makes its point well about using good passwords. There is nothing absolute about security and my opinion is that no one outside of an organization can know what methods are more/less important. My advice is simply what can be helpful but not on which ones may be more or less important. Keys+password absolutely...but not possible for automated processes. But, anything is better than rlogin and friends or telnet+expect! – JGurtz Apr 4 '11 at 19:11
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.