0

When I run ps aux command in my Centos 7 machine, I see about 100 entries:

root     19862  0.0  0.0 151692     8 ?        Ss   Oct09   0:00 sshd: unknown [priv]
sshd     19864  0.0  0.0 105068     0 ?        S    Oct09   0:00 sshd: unknown [net]

I'd like to ask whether this is normal, or is my system under some kind of ssh brute force attack?

Thanks!

2
  • You could execute last command to see who is logged and was logged to your server. Oct 15, 2017 at 14:51
  • That command list all previous and current logins as root from my IP range.
    – aye
    Oct 15, 2017 at 14:59

2 Answers 2

3

Yes, this is normal. sshd opens 2 new processes for each user currently trying to authenticate.

Yes, it is very likely indicates someone attempting to authenticate to your server who was not meant to. If not, one look into you /var/log/auth.log should point you to the server in your network that has a deprecated cron script running.

Rule of thumb: If you are concerned that someone might break in, then the issue is not people trying to break in! Instead, ensure that nobody will ever succeed brute-forcing.

You can tune your sshd config in order and somewhat restrict how much system resources are spent dealing with these. But the defaults should be fine for any but the thinnest servers, its really not that much of a problem.

# Disable unused authentication methods
#  !! ONLY DISABLE PASSWORDS IF ALL USERS LOGIN USING KEYS !!
PasswordAuthentication no

# If the above is true, also limit the time users have to present
#  their authentication
# If theres no passwords typed, something <60 seconds is reasonable
#  !! DO NOT SET TOO LOW! USERS MAY STILL NEED TO UNLOCK THEIR KEY/CARD !!
LoginGraceTime 120

# Limit how many times a user can attempt to authenticate
#  !! Users who initially try the wrong key or invalid method will
#  !! first need to configure their ssh client properly
#  !! else they will be locked out if this is too low!
MaxAuthTries 6

# Limit the number of concurrently authenticating users
# start not accepting some connections if there are already 10 clients
# stop accepting any connections if there are already 100 clients
#  !! one may even argue leaving this high is helpful, because
#  !! an attacker needs more resources to prevent legitimate connections
MaxStartups 10:30:100

You also can move your ssh to another port, which will greatly limit the number of people trying. I do not recommend doing that. It does not improve security and it makes things more complicated.

1

First I agree with what @anx says.

A few things to add (something I do):

  • For convenience purposes fail2ban can be used which parses log files and blocks brute force attacks. This does not increase security, but reduces noise in your logs.
  • To increase security use key based logins.
    • To take this to a next level an openpgp card could be used to store the key so it is no longer a file on disk which can be stolen. (The card signs request, but the key cannot be obtained from the card.)
  • A compromise to not completely disable password based logins is to add 2nd Factor Authentication.
    • google authenticator pam module and an android app can be installed. It can be setup in a way that when logging in you need to enter the number generated by your phone (or another software of hardware based calculator) in addition to the password. It is a time based token so if the cryptographic checks succeed it grants you login.
  • The key based login and the 2nd factor authentication can be both enabled at the same time.

Tutorial: how to install fail2ban on centos 7

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .