I'm very new to network administration, so please regard that I'm not that experienced yet.
I have a Ubuntu root server with plesk panel.
Yesterday my friends and I noticed that the quality of speech on our TS3 got very bad. I sent some pings to the server and there was a very high packet loss.
After that i googled a bit and found out that there is a
I downloaded it and scrolled a bit around, then I found this:
May 13 10:01:27 rs204941 sshd: input_userauth_request: invalid user student [preauth] May 13 10:01:27 rs204941 sshd: pam_unix(sshd:auth): check pass; user unknown May 13 10:01:27 rs204941 sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.127.116.11 May 13 10:01:29 rs204941 sshd: Failed password for invalid user student from 18.104.22.168 port 39806 ssh2 May 13 10:01:29 rs204941 sshd: Received disconnect from 22.214.171.124: 11: Bye Bye [preauth] May 13 10:01:31 rs204941 sshd: Invalid user student from 126.96.36.199
It seems like someone tried to log in over SSH many times. I scrolled a bit around, and saw, that this someone tries to use many different usernames:
student, tech, psi, news,...
Hundreds of these logins were displayed in the file.
I looked up the traffic statistics at the website of my datacenter. It was only at 17MB per hour. I have a 100Mbit Backbone, so the data transfer itself seems not to be the problem.
At the moment i cannot get acces to the server in any way.
My Question is: how can i get acces again, how can i surpress this attack and prevent following attacks?