5

I'm seeing lots of logs with this line:

Nov  7 03:47:41 s1 sshd[23430]: Received disconnect from XX.XXX.XX.XX: 11:
Nov  7 05:08:16 s1 sshd[24474]: Received disconnect from XX.XXX.XX.XX: 11:
Nov  7 06:33:59 s1 sshd[25526]: Received disconnect from XX.XXX.XX.XX: 11:
Nov  7 08:06:33 s1 sshd[26601]: Received disconnect from XX.XXX.XX.XX: 11:
Nov  7 09:24:14 s1 sshd[27460]: Received disconnect from XX.XXX.XX.XX: 11:
Nov  7 10:59:49 s1 sshd[28821]: Received disconnect from XX.XXX.XX.XX: 11:
Nov  7 12:14:39 s1 sshd[29894]: Received disconnect from XX.XXX.XX.XX: 11:

I've only paste 7 lines here but I have hundreds of them in the logs file. The IP is always the same.

I was told this indicates that my server was hacked and the attacker somehow managed to clear the log entries that registered the login information, because in order to have a "disconnect" message, I must have an "Accepted ..." message for the same IP before. Is this true?

My questions are:

  • With these logs can I conclude that my server was really hacked?
  • What does this message even mean? I've read somewhere that the :11 stands for: "SSH2_DISCONNECT_BY_APPLICATION" but I don't understand what it really means.

The server runs CentOS and has SSH password authentication turned off. The only logs that says "Accepted publickey ..." are from my own public IP address. So I guess they are not logging in through that method, unless the attacker is really clearing any trace, correct?

Many thanks in advance.

Improve this question
3
  • Perhaps there are other lines indicating that this behavior is normal, but you left them out and censored the IPs involved, so it's hard to tell.
    – gparent
    Nov 9, 2015 at 17:57
  • Thanks for the comment. I did a quick grep for the IP address in question and all lines were exactly the same message as I posted above. There are in fact other lines in the logs but they all refer to different IPs so I didn't think it was relevant to post them all here. Maybe for a different question.
    – Robson Junior
    Nov 9, 2015 at 23:32
  • Good answer to this question: security.stackexchange.com/a/44254/182091
    – ederag
    Jul 13, 2018 at 15:41

2 Answers 2

Reset to default
6

it is brute force attacks

this is method try to find login access by sending login request then testing the result, as long as result is not logged in, it retry another combinaison of login/password until access is granted

mainly aimed on internet:

  • FTP (usualy port 21)
  • SSH (usualy port 22)
  • TS (usualy port 3389)
  • Web site login pages (usualy port 80 & 443)

to prevent this kind of attacks:

  • (if possible) changing default port
  • having a complex password
  • trying to avoid use of basic login name (admin/root/administrator,...)
  • having a "fail attempt" temporizer, like that it will take too much time to find the good login/password combinaison.

Today most of system tool are enougth secure against this kind of attacks

i don't think you get hacked unless you had an low couple login/password level. this log don't say anything except the attemps failed.

if Hackers got logged in they would have deleted all logs, not only some logs (too much time for nothing).

What you can do (if you really think you have been hacked) is to check if you have a period without logs or missings logs.

as suggeted you can use some tool to prevent thoose attacks like fail2ban

For information the message SSH2_DISCONNECT_BY_APPLICATION in your case mean that this is a zombie login attempt from a botnet that is authored in Java

Improve this answer
2
  • Thanks for the explanation. It makes sense what you say. A hacker probably wouldn't bother to delete only a few lines, for what? I don't have any other suspicious activity going on that may indicate that someone really got in and I did look through all the logs and they seem very consistent with apparently no missing periods of time. So I guess I can safely conclude that I wasn't hacked yet :) yay! I'll make sure to try fail2ban as others suggested. Many thanks!
    – Robson Junior
    Nov 9, 2015 at 23:39
  • i ve added the meaning of your error message
    – Froggiz
    Nov 10, 2015 at 9:13
2

It is just a "spam" from probes browsing the internet. They are not dangerous if you don't allow password authentication. These messages are probably only the noise, since they usually don't know any other authentication than password.

To reduce the noise it is possible to set up some fail2ban, fwknop or move the service to other port.

Improve this answer
1
  • Good to know they are not "dangerous" since I don't have password authentication enabled :) I'll try your suggestion and install fail2ban. Many thanks.
    – Robson Junior
    Nov 9, 2015 at 23:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .