2

I noticed my internet speed slowed to a crawl. I restarted my home Ubuntu server and the speed immediately increased. So I checked the active network connections with netstat -tupn and found a connection that was suspicious from an unknown user:

enter image description here

I traced the IP address, and it was coming from a Chinese Telecom company, queue alarm bells.

So my next port of call was to check the ssh login attempts to my server, and I noticed I was getting loads - loads - of failed password attempts:

enter image description here
(Click image to enlarge)

The next step is I just turned off port forwarding for SSH on my router - something which I'm sure is pretty secure anyway. The connection attempts immediately halted.

Am I right in thinking someone was brute-forcing my server? How can I prevent something like this from happening again? I'd like to re-enable port forwarding for ssh again at some point, but not if it means I'm going to be bombarded by login attempts again.

I still have smb port forwarding to my server enabled. Is this safe?

I'm new to this stuff. I only set this server up (my first) earlier this year to collaborate on a project, so any guidance from the server gurus here would be much appreciated. :)

2
  • Unless you want to allow anyone from outside of your LAN to connect to your LAN, you need to deny any address, not on your LAN from connecting. Otherwise the minute you enable port forwarding again the attacks will continue. You have disable ssh root capabilities right? You should find the point where the malicious user was able to successfully authenticate.
    – Ramhound
    Apr 20, 2016 at 20:42
  • Do you know what message would denote a successful authentication? So I can search for it
    – ryansin
    Apr 20, 2016 at 22:09

4 Answers 4

8

Why? Because you have a system on the internet.

A few simple steps you can take to combat this:

  1. Disable password authentication and use key auth instead.
  2. Put in place firewall rules to only accept SSH connections from IP addresses where you'll be connecting from.
  3. Install something like fail2ban, which can watch your SSH logs for brute-force attempts and firewall off the offending IP addresses automatically.

I still have smb port forwarding to my server enabled. Is this safe?

No. Very no.

SMB should not be accessible over the internet. Full stop. If you need access to SMB shares remotely, then do so via a VPN tunnel.

5
  • 1
    Thanks EEAA. Not sure I've heard of using key auth, how would I go about setting that up? The SSH port forwarding was only enabled while I was accessing it from outside my home network. I'm not doing so anymore so I may as well just leave it disabled I guess. Fail2ban sounds interesting, I'll have a look into that. Thanks again!
    – ryansin
    Apr 20, 2016 at 18:47
  • 2
    @user2696497 There are lots of guides around the internet on how to set up key authentication.
    – EEAA
    Apr 20, 2016 at 18:47
  • 1
    Do I need to be concerned about the established "unknown" connection mentioned in the post?
    – ryansin
    Apr 20, 2016 at 19:07
  • Yes; you should be concerned
    – Ramhound
    Apr 21, 2016 at 11:42
  • Given Microsoft's recent disclosure re: Badlock, it seems like a particularly bad time to have SMB exposed, especially if you're not patched. Apr 25, 2016 at 18:44
1

I agree with @richard-boonen. I have had a ssh port forwarding setup for a year now and have had no signs of someone trying to brute force the system (since the default port 22 is not enabled). Of course someone could find this port and then attack, but the likelihood of an attack on a non-default port is certainly less than the default port.

Below are the steps to change the config file

Edit the config file:

1) Open a terminal (use nano or whatever text editor you choose)

sudo nano /etc/ssh/sshd_config

Look for the following --

# What ports, IPs and protocols we listen for
Port 22 # ==> change 22 to another port (make sure that it does not conflict with applications that use specific ports)
1

It is quite possible a brute-force attack was in progress, although if so, it was not a very effective one. Its quite possible someone made an error in a script somewhere to hit the wrong IP address. (I say this because the requests are all coming from a single IP address, and they are not coming in that fast).

As others have said, having SMB exposed directly to the Internet is begging to be hacked - use a VPN or firewall it to specific, known, static IP's you need to communicate with. (Even firewalling is not a great idea because people can still sniff the data in-flight)

0

the answer of @EEAA obviously covers everything important, I would like to add that it in addition you can also move your ssh port to a non-standard port, that further lowers the amount of attacks a little bit at least.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .