Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a Gentoo Linux server, and use Fail2Ban to block the script kiddies and their relentless banging on my SSH port. (Yes I know I can move to a different port number, but that is work, and who wants to do that? :) )

So anyway, that is working great, I catch a lot of people trying to break in, and ban them, but then I noticed this interesting message, and LOTS of them.

Oct 12 18:00:57 SERVERNAME sshd[23265]: SSH: Server;Ltype: Version;Remote: 216.177.200.29-46386;Protocol: 2.0;Client: libssh-0.1

There are more than 1000 of them in a 5 min window, all from the same remote IP address. Is this a breakin attempt? And if so, what kind is it? I have tried looking this up, but couldn't get a clear answer on what was going on here.

Because there was no specific attempt to login, my fail2ban didn't flag IPTables to block it. I just wanted to be sure I'm not being exposed to some known vulnerability in the SSHD daemon.

share|improve this question
2  
I don't know if changing a line in the sshd_config file could constitute as "work" –  DKNUCKLES Oct 13 '11 at 20:19
    
I know, I was being snarky. Obviously my fail2ban system was substantially more complex to setup and get working correctly, I just see everyone suggesting moving the ssh port whenever there are ssh brute forcing questions that come up, and I would rather not move my SSH port. Hence I preempted it with "moving the ssh port isn't what i'm looking to do" –  dynamphorous Oct 13 '11 at 20:36
1  
For me it wouldn't just be changing a line in the sshd_config file.. it would be chaning dozens of scripts on dozens of servers as well. yup, it would definitely be "work". –  Safado Oct 13 '11 at 22:32

2 Answers 2

up vote 2 down vote accepted

Either someone was trying to brute force your password or less likely they are trying to crack your ssh keys. SSHD will not log failures in some cases. There was some discussion on mailing lists that you could crack ssh keys via a remote brute force in less then 2 hours.

Justin Mason has a good write up on his blog about it.

share|improve this answer
    
Well I figure if someone were trying to brute force my password I would expect to see Oct 13 02:21:03 SERVERNAME sshd[23968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.215.11.171 user=root as a second line after each of the above mentioned line. This just seems to be poking my SSH server without actually trying to break in. –  dynamphorous Oct 13 '11 at 20:38
    
Read the article he provided dude. it specifically says: it shows the connection attempt, but NOT the failure –  transistor1 Oct 13 '11 at 20:46
    
I did read the article and see that it says it does NOT log the failure. However I guess what I'm missing here is that the users I have provided with public keys it logs when they enter and exit. Is this a problem with SSHD that it doesn't log these blatant break in attempts? And is there ANY way to force the logging of the errors so fail2ban can catch and block these? –  dynamphorous Oct 13 '11 at 20:51
2  
For clarity: Normal SSH keys cannot be cracked in 2 hours. That would defeat their purpose. Broken keys generated by OpenSSH on Debian back in 2008 were weak due to an OpenSSL bug and can be guessed. debian.org/security/2008/dsa-1571 –  Alex Holst Oct 14 '11 at 10:38

iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT

iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT

Try this, this way you drop more than 4 connections in a 60 seconds frame from the same IP drop he Ip for 60 seconds, but accept traffic from pre-established connections. It does not block the IP but slows it down in attempts.

share|improve this answer
    
Oh an excellent idea. I will leave Thomas's post as the "answer" because the question I asked was specifically about what the attack was, however I up voted your answer, and really do appreciate the suggestion. I didn't realize IP tables even had the ability to check for dropped connections and slow people down this way. Gotta love these exchange sites for just this kinda knowledge! Thank you –  dynamphorous Oct 14 '11 at 18:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.