Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In /var/log/auth.log on my server connected to the Internet I have the following:

Jul  6 10:04:17 ubuntu sshd[28207]: Connection from port 48921
Jul  6 10:04:19 ubuntu sshd[28207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=  user=root
Jul  6 10:04:20 ubuntu sshd[28207]: Failed password for root from port 48921 ssh2
Jul  7 17:00:40 ubuntu sshd[2185]: Connection from port 4555
Jul  7 17:00:42 ubuntu sshd[2185]: reverse mapping checking getaddrinfo for [] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul  7 17:00:42 ubuntu sshd[2185]: Failed none for root from port 4555 ssh2

And many other login attempts with different ports. I am behind a router, on which I enabled only the default ssh port (with port forwarding) for my Ubuntu server, then why are these ports in the auth.log? No DMZ enabled in router.

share|improve this question

migrated from Jul 8 '10 at 6:44

This question came from our site for system and network administrators.

These are the source ports from which the connection comes from, not your destination ssh port.

As long as you have ssh open on the standard port (22), you will get these kind of automated attacks. If it bothers you, you can move your ssh server to another random port (use the Port directive in /etc/ssh/sshd_config, and reflect the change on your router).

You can also use something like fail2ban to automatically block them after a number of failed attempts. But if it comes from several hosts, like it seems to be the case here (probably some botnet attack), fail2ban won't be as effective.

share|improve this answer
I personally like denyhosts instead of fail2ban, but that's my preference. Does fail2ban allow for downloading banned IP's from other systems like denyhosts? – Bart Silverstrim Jul 7 '10 at 17:14
Thanks guys, I am already playing with fail2ban/denyhosts. This is the important info what I looked for: These are the source ports from which the connection comes from, not your destination ssh port. – Adrian Jul 7 '10 at 17:23
Actually, I don't like fail2ban that much either; whenever it relies on syslog output, it creates a local DoS opportunity. I haven't played with denyhosts yet, but so far for me, changing the default port and/or using port knocking has been simpler and more effective (yes, security trough obscurity is bad, I know :) – b0fh Jul 8 '10 at 11:52

Bullet-proof SSH server should look like:

  1. Non-standart port
  2. Only the private keys to authenticate
  3. Fail2ban to ban IP's which fails to authenticate in, let's say 5 times in a row

Sleep well :-)

share|improve this answer
Bullet-proof server is one without any i/o... – squillman Jul 7 '10 at 17:09
Andrejs, thanks for the tip, this is what I will do next! ANother great guide:… squillman: by the way +1, you have right!! – Adrian Jul 7 '10 at 17:26
I would argue that non-standard port buys you almost nothing, and is only an inconvenience. Any attacker with more motivation than a script kiddy will find that port and attack it. – Zypher Jul 7 '10 at 21:38
Oh and nothing in IT is bullet proof real or figurative – Zypher Jul 7 '10 at 21:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.