6

I logged into a CentOS box today to find the following"

There were 11126 failed login attempts since the last successful login.
Last login: Tue Mar 10 14:36:47 2015 from X.X.X.X

Thats 11 THOUSAND login attempts in the last 3 days. WTF? Please note that this is a brand new IP I got from my provider and the box is brand new. I've yet to publish anything off of this box.

Why would I be getting such a large number of login attempts? Is it some kind of IP / Port scan?

There are essentially 4 culprits, 2 from China (MOVEINTERNET-NETWORK), 1 from Hong Kong (HEETHAI-HK) and 1 from Verizon (Verizon Online LLC (VRIS)).

This is only happening on SSH. No issues on HTTP. Should I Null route the culprit subnets? What do you guys suggest?

Improve this question
5
  • 3
    Welcome to internet, see: serverfault.com/questions/244614/…
    – Federico Sierra
    Mar 12 '15 at 18:48
  • 1
    Typical internet background noise. If you can: configure a firewall to only allow inbound SSH from trusted ip-address ranges. A common way to automate blocking repeat offenders automatically if you can't do that is fail2ban.
    – HBruijn
    Mar 12 '15 at 18:49
  • Should I do it @ the router level? Or at my machine level?
    – fizzy drink
    Mar 12 '15 at 18:53
  • The providers from China should have an abuse-contact in their whois-entries, you can complain there (only once, not for every attempt). And for the one from verizon, go and complain at the FBI (also only once).
    – ott--
    Mar 12 '15 at 20:24
  • @fizzydrink. Router or machine: either one is fine. They both prevent it from reaching the application layer.
    – Michael Martinez
    Mar 12 '15 at 21:40
10

You will only get "failed login attempt" messages on accounts that you're actually logging into. Since SSH scanners typically try some common names of people, and also known system accounts like 'root', what that message tells me is that you're logging in as root directly over SSH. You should not do this.

The first thing to do is create a regular user account for yourself and then grant that user sudo rights. Then disable 'root' account login through SSH in the /etc/ssh/sshd_config file (and restart sshd). This will prevent anyone from logging in as root, even if they happen to guess the password.

Further, you should disable password-based logins and only allow SSH keys, however this can be a bit of a pain, so make sure you are comfortable with it before doing that.

You can also change the port that ssh listens on (default 22). This will reduce the noise in the log, but it does not add extra security. The only purpose of doing this is to reduce log noise.

Another option to to disable SSH access from the Internet altogether (block the port at the firewall), but then you'll need a VPN into the firewall before you can access the server via SSH.

You are always going to get scanned if you have a server on the Internet, it's just a fact of life.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.