1

When I login in my server using ssh, it shows me a message with the number of failed logins since the last sucessfull login. Currently I have this:

Last failed login: Wed Jan 28 17:54:17 EST 2015 from 103.41.124.30 on ssh:notty
There were 1125 failed login attempts since the last successful login.

My question is: is this normal?

Also currently I'm using an ssh key for login. Is there anything more I can do to protect my server?

Thanks

1

3 Answers 3

2

No, it's not 'normal', but within the realm of being targetted. Check your logs for ssh login attempts. It looks like a bruteforce password attempt with your username. Please make sure ssh is disabled for root. And I hope you have a strong password. => actually, if you are using a key/cert to login, you should disable ssh logins with passwords, unless you want to leave that there to misguide the attacker.

When you look at the ssh attempts in the log, if you are lucky, you can figure out who's trying to mess with you. But it might just be another generic botnet attack :-(

7
  • 1
    You may also want to ensure you have a three strikes your out rule for a password policy to prevent people from grinding the server if it's public
    – Citizen
    Jan 28, 2015 at 23:09
  • 1
    Some sysadmins/devs/operators find that very annoying, feel free to ask my colleagues ;-)
    – DutchUncle
    Jan 28, 2015 at 23:11
  • 1
    I know those guys. lol
    – Citizen
    Jan 28, 2015 at 23:12
  • 1
    I'm glad to hear it makes you smile :-) Botnets often use low frequency attempts these day, which is at odds with brute force password guessing, but I guess it works for them. Search the web for 'hail mary cloud' :-)
    – DutchUncle
    Jan 28, 2015 at 23:37
  • 1
    From what I see, there where two bots. One was trying random usernames but with a low frequency of attempts, and another one using root as username and with a high frequency
    – Luis Alves
    Jan 28, 2015 at 23:40
1

If the account you are using is named root (or something else rather common) and sshd is exposed to the internet, yes this within the normal range.

You say you are using an ssh key for login. Is password authentication permitted? You could disable it. (If the account is root consider PermitRootLogin without-password.) Also, install fail2ban.

0

I highly recommend change if you are using default weird 22 port. If you dont have a firewall, you must have one. I use csf in my environment and it has some block rules for brute force attackers.

3
  • Changing the default port is not much of a defense, and more hassle than it's worth. There's plenty of bots that also port scan and figure out where your sshd daemon lives.
    – DutchUncle
    Jan 28, 2015 at 23:14
  • 1
    Since i was using default port, my firewall blocking over 500 failed ssh login ips per day. Now i have 0 failed ssh login in my environment. Thats why i shared my experience.
    – HddnTHA
    Jan 28, 2015 at 23:16
  • Ouch, thank you for sharing. I guess I've been luckier with IP address range/datacenter/cloud provider. Also I guess we get more targetted attacks because of big fat mailservers & userbase.
    – DutchUncle
    Jan 28, 2015 at 23:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .