I run a CentOS 5.7 64bit server which has a strange issue.
While I was watching my logs at
/var/log/secure I noticed that one strange IP was trying to connect to ssh with a lot of strange usernames.
Output of the log: http://pastebin.com/raw.php?i=3uYjPrLL
I run fail2ban which had already blocked this IP, and I also blocked this IP again manually via iptables.
iptables -n -L I got this output:
Chain fail2ban-SSH (1 references) target prot opt source destination DROP all -- 220.127.116.11 0.0.0.0/0 RETURN all -- 0.0.0.0/0 0.0.0.0/0
So the block is in place. Iptables is also running, and I have blocked many IP's via iptables already, and those blocks are all working fine.
But somehow this IP is able to get to my machine. Any idea how this is possible?