I need help to decide if my server has been hacked in.
The server has
sshd turned on. The other day, I tried
lsof -i TCP to see someone is connecting to the server before I restart it. Then I noticed the following output:
sshd 19400 root 3u IPv6 224125 0t0 TCP [2600:3c01::f03c:91ff:fe57:c70b]:ssh->123.456.789.123:59030 (ESTABLISHED) sshd 19409 me 3u IPv6 224125 0t0 TCP [2600:3c01::f03c:91ff:fe57:c70b]:ssh->123.456.789.123:59030 (ESTABLISHED) sshd 10623 root 3u IPv4 123099 0t0 TCP www.playandlearn.xyz:ssh->220.127.116.11:49085 (ESTABLISHED) sshd 10624 sshd 3u IPv4 123099 0t0 TCP www.playandlearn.xyz:ssh->18.104.22.168:49085 (ESTABLISHED)
The first two lines are for my ssh connection (I changed my ip address to a fake one).
The user name shown in last line is
sshd, not something I expected. I then searched the ip address
22.214.171.124, and found out that some sites listed it as malicious address.
Trying to figure out how this address logged in the server, I grepped it from
/var/log/auth.log, but only find (a lot of) lines like:
Mar 23 18:59:42 www sshd: Received disconnect from 126.96.36.199 port 19152:11: [preauth] Mar 23 18:59:42 www sshd: Disconnected from 188.8.131.52 port 19152 [preauth]
There was no entries for successful login from this address.
After a few hours, the connection was disconnected. Since then, I randomly checked a few times and hasn't seen any connections from the suspicious address.
But today I noticed the same symptoms for another ip address: showed up as user "sshd" in
lsof, a lot of unsuccessful tries to connect, but no successful login entry in
So my questions are:
- Are those listings in
lsof -i TCPevidences that they have connected successfully, or they are just trying to connect. Note that in the first case, the connection seems lasted for a few hours.
- If they have hacked in, why I can't find relative logs in
- After wrote down all these, I realize that maybe those connections are connections to my web server? One of the pages uses web socket, that might explains the long connection time?
Thanks for your help. Please let know if I need to provide more info.