0

I have a vps setup with simple fail2ban settings to keep from brute force attacks. However in my tcptrack monitor I see an IP that establishes several connections to my server. The TCPTrack shows that the ip address is "ESTABLISHED" through port 22.

The address 116.31.116.17 is shown several times with an established connection. I have tried to ban this ip address with:

/sbin/iptables -A INPUT -s 116.31.116.17 -j DROP

But it still shows up in tcptrack after I reset the server. I looked up this address in iplookup and it's an ip address from china. Not sure how to handle this intrusion. Any help would be appreciated.

  • Please post the complete firewall. – Michael Hampton Oct 13 '16 at 2:16
  • How is it relevant to nginx? – Alexey Ten Oct 13 '16 at 4:43
  • -I would be more appropriate than -A, because I suppose there are rules that permit already-established connections. What do you mean by "reset the server"? – Law29 Oct 13 '16 at 5:51
  • If the same TCP connection stays active for a long period, then it is likely an active and authenticated SSH session. This would mean that your server is compromised and you need to restore it from backups. – Tero Kilkanen Oct 13 '16 at 10:55
  • @Law29 I reset the server with sudo service restart nginx – Isaac Pak Oct 13 '16 at 12:42
0

The server was compromised as you guys stated so I rebuilt another. I installed tracker again and saw the same ip address attacking again. Further investigation in /var/log/auth.log revealed a bot trying passwords with root user. I have now created a new vps removing root login and also used the iptables ban rule but now it persists when I save it with /sbin/iptables-save. I didn't realize that servers were so vulnerable from the instant you create them. Thanks for all the help.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.