Is someone bruteforcing my password? sshd: unknown [net] and sshd: [accepted] flashing in htop

Question

My VPS has around 3% CPU load, which is probably caused by sshd: unknown [net] and sshd: [accepted] commands appearing around once per second and quickly disappearing in htop.

Does it mean somebody is trying to bruteforce my password? What do I do about it?

Answer 1

Check your /var/log/auth.log you should see a high number of failed attempts if someone is trying to attack you. It's commonly known as Internet Background noise.

You can install a a host based intrusion detection system like OSSEC and enable the active response to temporarily block offending IP addresses.

Answer 2

1. Check your /var/log/auth.log

2. Install fail2ban and autoban ssh bruteforcers. You can edit /etc/fail2ban/jail.conf:

   [ssh]
   
   enabled = true
   port    = 22
   filter  = sshd
   logpath  = /var/log/auth.log
   bantime = -1
   maxretry = 5