0

I have a vps setup with simple fail2ban settings to keep from brute force attacks. However in my tcptrack monitor I see an IP that establishes several connections to my server. The TCPTrack shows that the ip address is "ESTABLISHED" through port 22.

The address 116.31.116.17 is shown several times with an established connection. I have tried to ban this ip address with:

/sbin/iptables -A INPUT -s 116.31.116.17 -j DROP

But it still shows up in tcptrack after I reset the server. I looked up this address in iplookup and it's an ip address from china. Not sure how to handle this intrusion. Any help would be appreciated.

Improve this question
9
  • Please post the complete firewall.
    – Michael Hampton
    Oct 13, 2016 at 2:16
  • How is it relevant to nginx?
    – Alexey Ten
    Oct 13, 2016 at 4:43
  • -I would be more appropriate than -A, because I suppose there are rules that permit already-established connections. What do you mean by "reset the server"?
    – Law29
    Oct 13, 2016 at 5:51
  • If the same TCP connection stays active for a long period, then it is likely an active and authenticated SSH session. This would mean that your server is compromised and you need to restore it from backups.
    – Tero Kilkanen
    Oct 13, 2016 at 10:55
  • @Law29 I reset the server with sudo service restart nginx
    – Isaac Pak
    Oct 13, 2016 at 12:42

1 Answer 1

Reset to default
0

The server was compromised as you guys stated so I rebuilt another. I installed tracker again and saw the same ip address attacking again. Further investigation in /var/log/auth.log revealed a bot trying passwords with root user. I have now created a new vps removing root login and also used the iptables ban rule but now it persists when I save it with /sbin/iptables-save. I didn't realize that servers were so vulnerable from the instant you create them. Thanks for all the help.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .