Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In /var/log/auth.log on my server connected to the Internet I have the following:

Jul  6 10:04:17 ubuntu sshd[28207]: Connection from 221.111.75.119 port 48921
Jul  6 10:04:19 ubuntu sshd[28207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=softbank221111075119.bbtec.net  user=root
Jul  6 10:04:20 ubuntu sshd[28207]: Failed password for root from 221.111.75.119 port 48921 ssh2
Jul  7 17:00:40 ubuntu sshd[2185]: Connection from 41.238.117.10 port 4555
Jul  7 17:00:42 ubuntu sshd[2185]: reverse mapping checking getaddrinfo for host-41.238.117.10.tedata.net [41.238.117.10] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul  7 17:00:42 ubuntu sshd[2185]: Failed none for root from 41.238.117.10 port 4555 ssh2

And many other login attempts with different ports. I am behind a router, on which I enabled only the default ssh port (with port forwarding) for my Ubuntu server, then why are these ports in the auth.log? No DMZ enabled in router.

share|improve this question

migrated from serverfault.com Jul 8 '10 at 6:44

This question came from our site for professional system and network administrators.

2 Answers 2

These are the source ports from which the connection comes from, not your destination ssh port.

As long as you have ssh open on the standard port (22), you will get these kind of automated attacks. If it bothers you, you can move your ssh server to another random port (use the Port directive in /etc/ssh/sshd_config, and reflect the change on your router).

You can also use something like fail2ban to automatically block them after a number of failed attempts. But if it comes from several hosts, like it seems to be the case here (probably some botnet attack), fail2ban won't be as effective.

share|improve this answer
1  
I personally like denyhosts instead of fail2ban, but that's my preference. Does fail2ban allow for downloading banned IP's from other systems like denyhosts? –  Bart Silverstrim Jul 7 '10 at 17:14
    
Thanks guys, I am already playing with fail2ban/denyhosts. This is the important info what I looked for: These are the source ports from which the connection comes from, not your destination ssh port. –  Adrian Jul 7 '10 at 17:23
    
Actually, I don't like fail2ban that much either; whenever it relies on syslog output, it creates a local DoS opportunity. I haven't played with denyhosts yet, but so far for me, changing the default port and/or using port knocking has been simpler and more effective (yes, security trough obscurity is bad, I know :) –  b0fh Jul 8 '10 at 11:52

Bullet-proof SSH server should look like:

  1. Non-standart port
  2. Only the private keys to authenticate
  3. Fail2ban to ban IP's which fails to authenticate in, let's say 5 times in a row

Sleep well :-)

share|improve this answer
1  
Bullet-proof server is one without any i/o... –  squillman Jul 7 '10 at 17:09
    
Andrejs, thanks for the tip, this is what I will do next! ANother great guide: cyberciti.biz/tips/… squillman: by the way +1, you have right!! –  Adrian Jul 7 '10 at 17:26
    
I would argue that non-standard port buys you almost nothing, and is only an inconvenience. Any attacker with more motivation than a script kiddy will find that port and attack it. –  Zypher Jul 7 '10 at 21:38
1  
Oh and nothing in IT is bullet proof real or figurative –  Zypher Jul 7 '10 at 21:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.