I noticed my internet speed slowed to a crawl. I restarted my home Ubuntu server and the speed immediately increased. So I checked the active network connections with netstat -tupn
and found a connection that was suspicious from an unknown user:
I traced the IP address, and it was coming from a Chinese Telecom company, queue alarm bells.
So my next port of call was to check the ssh login attempts to my server, and I noticed I was getting loads - loads - of failed password attempts:
The next step is I just turned off port forwarding for SSH on my router - something which I'm sure is pretty secure anyway. The connection attempts immediately halted.
Am I right in thinking someone was brute-forcing my server? How can I prevent something like this from happening again? I'd like to re-enable port forwarding for ssh again at some point, but not if it means I'm going to be bombarded by login attempts again.
I still have smb port forwarding to my server enabled. Is this safe?
I'm new to this stuff. I only set this server up (my first) earlier this year to collaborate on a project, so any guidance from the server gurus here would be much appreciated. :)