Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
Mar  2 02:34:02 freetalker3 sshd[28436]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:08 freetalker3 sshd[28439]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:13 freetalker3 sshd[28442]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:19 freetalker3 sshd[28445]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:24 freetalker3 sshd[28448]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:30 freetalker3 sshd[28451]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:35 freetalker3 sshd[28454]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:41 freetalker3 sshd[28457]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:46 freetalker3 sshd[28460]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:52 freetalker3 sshd[28463]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:57 freetalker3 sshd[28466]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:03 freetalker3 sshd[28469]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:08 freetalker3 sshd[28472]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:14 freetalker3 sshd[28475]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:20 freetalker3 sshd[28478]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:25 freetalker3 sshd[28481]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:31 freetalker3 sshd[28484]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:36 freetalker3 sshd[28488]: Did not receive identification string from 211.110.33.50

My /var/log/auth.log is full of these messages, spammed every 6 seconds. my server is on vps and the ip seems like it is an internal ip. what could be the cause of this issue?

share|improve this question
    
Do you have cron jobs running under root? –  Shimon Rachlenko Mar 1 '13 at 18:44
add comment

4 Answers 4

up vote 2 down vote accepted

Some miscreant (surprise!) is hammering at ssh to try to find a username/password combination that gets them into the system. Probably from some botnet doing the same to who knows how many other unsuspecting victims.

Install something like fail2ban or DenyHosts (some of both should be available for any Linux distribution), or set up your local firewall to limit SSH connection attempts. Changing the SSH port makes the dumb brute force tries fail, but it also makes legitimate uses fail.

share|improve this answer
    
Don't forget: sshguard –  0xC0000022L Mar 2 '13 at 2:47
add comment

actually, this was from my hosting provider - they spam my vps every 6 seconds, to show my server status on their web consonle. My server is displayed as active if my sshd answers them.

I just installed openvpn and allowed ssh only via that - so, according to my providers my server boasts 100% downtime.

share|improve this answer
2  
Protocol-insensitive heartbeat checkers are annoying. –  Falcon Momot May 7 '13 at 22:02
add comment

This is most likely a keepalive (verifying the server is responding) from a comm. device.

share|improve this answer
add comment

Try changing the ssh port from 22 to another one in sshd_config:

sudo nano /etc/ssh/sshd_config

If it doesn't stop messages, the issue can also be caused by this: http://www.freepbx.org/v2/ticket/3461 or see discussion here (http://ubuntuforums.org/showthread.php?t=1473914).

share|improve this answer
1  
thanks, the spammed messages are gone(at least for now) and I don't have freepbx installed. –  thkang Mar 1 '13 at 19:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.