0

My vServer hoster threatens to cancel our contract if I don't stop creating thousands (9000 to be precise) of SSH processes. I don't know if they made the processes defunct or if they were like this when they found them. They sent me a document containing thousands of lines like

sshd     19716  0.0  0.0      0     0 ?        Z    Jan25   0:00 [sshd] <defunct>
sshd     19739  0.0  0.0      0     0 ?        Z    Jan25   0:00 [sshd] <defunct>
sshd     19753  0.0  0.0      0     0 ?        Z    Jan25   0:00 [sshd] <defunct>
sshd     19776  0.0  0.0      0     0 ?        Z    Jan26   0:00 [sshd] <defunct>

I have no idea how that happened and I would like to know a solution so I won't get cancelled before turning the server on again!
The only thing I can think of is that I often connected to the server with an extremely unstable connection. Could that lead to the creation of thousand processes over weeks and months?
Could my server be hacked? I don't use fail2ban (nor do I know how) but I do use a keyfile.

The server runs on Debian with Apache & a Tomcat.

4
  • Can you provide a list of connections with an hour:min instead of a date (like Jan 25 in your list)? That helps to see the new connections rate. And also provide us with how many connections do you have on a single day, or per day on 2 or 3 days. Feb 9 '16 at 9:43
  • The list snippet I posted was provided by my hoster and my vServer is currently turned off, so I guess the information is lost.
    – ASA
    Feb 9 '16 at 9:48
  • You only have this 4 items count? If so, you just have to take precautions. Feb 9 '16 at 10:00
  • Here is the whole list they sent me: ncry.pt/p/W4Bn#TPmBAWNIedVQ3KnnV-omrz4xx5ZG8b__1LqaBaIL3tw
    – ASA
    Feb 9 '16 at 11:07
2

Take precautions. The options are from the best to the worst.

Option 1: use fail2ban to limit fails

Install fail2ban. That's your best option, as it blocks whoever tries to connect with invalid credentials after some attempts.

Option 2: limit failed attempts in iptables

Setup iptables to limit the new connections to SSH.

# Create new SSHSCAN chain
iptables -N SSHSCAN
# Send new SSH attempts to SSHSCAN chain.
iptables -A INPUT -m tcp -p tcp --dport 22 -m state --state NEW -j SSHSCAN
# Identify a recent-match list, based on the source address
iptables -A SSHSCAN -m recent --set --name SSH --rsource
# Log and drop if there are more than 5 
iptables -A SSHSCAN -m recent --update --seconds 10 --hitcount 5 --name SSH --rsource -j LOG --log-prefix "Anti SSH-Bruteforce: " --log-level 6
iptables -A SSHSCAN -m recent --update --seconds 10 --hitcount 5 --name SSH --rsource -j DROP

Check info for more info about recent match in iptables.

Thank you to @gaurav-pundir for the commands.

Option 3: limit the source of the SSH accesses

Optin 3 is setup firewall so that you ensure that only you can access: block SSH so that only you your IP (if it's static) or your providers network can access. The network block option is not pratical and you probably don't have the a fixed IP available. Even if it's the worst, for dynamic addresses, you may consider to implement it, even if you have one of the other options implemented.

Problem source

Edit: from your recent list it seems to me that your unstable connection is leaving zombie connections. This won't fix your problem, but would not make any harm, anyway.

2
  • command for option 2 "iptables -N SSHSCAN ; iptables -A INPUT -m tcp -p tcp --dport 22 -m state --state NEW -j SSHSCAN ; iptables -A SSHSCAN -m recent --set --name SSH --rsource ; iptables -A SSHSCAN -m recent --update --seconds 10 --hitcount 5 --name SSH --rsource -j LOG --log-prefix "Anti SSH-Bruteforce: " --log-level 6 ; iptables -A SSHSCAN -m recent --update --seconds 10 --hitcount 5 --name SSH --rsource -j DROP" Feb 9 '16 at 10:50
  • fail2ban sounds like the smartest idea and it seems to be best practice anyways. I am not even sure I got hacked though!
    – ASA
    Feb 9 '16 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.