I am currently under an SSH attack.
The attack is very strange in nature, the attacker is using a botnet of computers and using them as individual login attempts (see log snippet):
Dec 11 08:30:51 rhea sshd: Invalid user maureen from 220.127.116.11
Dec 11 08:35:24 rhea sshd: Invalid user maurizio from 18.104.22.168
Dec 11 08:44:46 rhea sshd: Invalid user max from 22.214.171.124
Dec 11 08:49:10 rhea sshd: Invalid user max from 126.96.36.199
Dec 11 08:58:19 rhea sshd: Invalid user max from 188.8.131.52
Dec 11 09:07:28 rhea sshd: Invalid user maxim from 184.108.40.206
Dec 11 09:12:03 rhea sshd: Invalid user maximus from 220.127.116.11
I am willing to filter all access to port 22 (ie only allow IPs I specify to connect), and what I have done a couple days ago (is block all connections to port 22 but from myself). What I want to do is log ALL connections that don't have an accept rule to log and drop it - this way I can track all the computers in the bot not without giving them the opportunity to attempt to login.
What I have is something like this:
-A INPUT -s my.addr(s) -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j DROP
I have added this to my iptables:
[0:0] -A INPUT -m limit --limit 5/min -p tcp -m tcp --dport 22 -j LOG --log-level 4 --log-prefix "** DoS **"
To setup a separate file, however, I can only see the logged data in dmesg.