1

When I login in my server using ssh, it shows me a message with the number of failed logins since the last sucessfull login. Currently I have this:

Last failed login: Wed Jan 28 17:54:17 EST 2015 from 103.41.124.30 on ssh:notty
There were 1125 failed login attempts since the last successful login.

My question is: is this normal?

Also currently I'm using an ssh key for login. Is there anything more I can do to protect my server?

Thanks

2

No, it's not 'normal', but within the realm of being targetted. Check your logs for ssh login attempts. It looks like a bruteforce password attempt with your username. Please make sure ssh is disabled for root. And I hope you have a strong password. => actually, if you are using a key/cert to login, you should disable ssh logins with passwords, unless you want to leave that there to misguide the attacker.

When you look at the ssh attempts in the log, if you are lucky, you can figure out who's trying to mess with you. But it might just be another generic botnet attack :-(

  • 1
    You may also want to ensure you have a three strikes your out rule for a password policy to prevent people from grinding the server if it's public – Citizen Jan 28 '15 at 23:09
  • 1
    Some sysadmins/devs/operators find that very annoying, feel free to ask my colleagues ;-) – DutchUncle Jan 28 '15 at 23:11
  • 1
    I know those guys. lol – Citizen Jan 28 '15 at 23:12
  • 1
    I'm glad to hear it makes you smile :-) Botnets often use low frequency attempts these day, which is at odds with brute force password guessing, but I guess it works for them. Search the web for 'hail mary cloud' :-) – DutchUncle Jan 28 '15 at 23:37
  • 1
    From what I see, there where two bots. One was trying random usernames but with a low frequency of attempts, and another one using root as username and with a high frequency – Luis Alves Jan 28 '15 at 23:40
1

If the account you are using is named root (or something else rather common) and sshd is exposed to the internet, yes this within the normal range.

You say you are using an ssh key for login. Is password authentication permitted? You could disable it. (If the account is root consider PermitRootLogin without-password.) Also, install fail2ban.

0

I highly recommend change if you are using default weird 22 port. If you dont have a firewall, you must have one. I use csf in my environment and it has some block rules for brute force attackers.

  • Changing the default port is not much of a defense, and more hassle than it's worth. There's plenty of bots that also port scan and figure out where your sshd daemon lives. – DutchUncle Jan 28 '15 at 23:14
  • 1
    Since i was using default port, my firewall blocking over 500 failed ssh login ips per day. Now i have 0 failed ssh login in my environment. Thats why i shared my experience. – HddnTHA Jan 28 '15 at 23:16
  • Ouch, thank you for sharing. I guess I've been luckier with IP address range/datacenter/cloud provider. Also I guess we get more targetted attacks because of big fat mailservers & userbase. – DutchUncle Jan 28 '15 at 23:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.