4

I SSH’d into my home server earlier because it was taking strangely long to respond to HTTP requests. I noticed that the shell prompt was also acting slow. So I typed top, and saw several instances of sshd using a lot of CPU time. I checked auth.log, and this is what I saw:

Jul 16 14:31:56 server sshd[5799]: reverse mapping checking getaddrinfo for 198-136-57-92.static.lvnoc.com [198.136.57.92] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 16 14:31:56 server sshd[5799]: User root from 198.136.57.92 not allowed because none of user's groups are listed in AllowGroups
Jul 16 14:31:56 server sshd[5799]: input_userauth_request: invalid user root [preauth]
Jul 16 14:31:56 server sshd[5799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.136.57.92  user=root
Jul 16 14:31:59 server sshd[5799]: Failed password for invalid user root from 198.136.57.92 port 54672 ssh2
Jul 16 14:31:59 server sshd[5799]: Received disconnect from 198.136.57.92: 11: Bye Bye [preauth]
Jul 16 14:32:00 server sshd[5802]: reverse mapping checking getaddrinfo for 198-136-57-92.static.lvnoc.com [198.136.57.92] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 16 14:32:00 server sshd[5802]: User root from 198.136.57.92 not allowed because none of user's groups are listed in AllowGroups
Jul 16 14:32:00 server sshd[5802]: input_userauth_request: invalid user root [preauth]
Jul 16 14:32:00 server sshd[5802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.136.57.92  user=root
Jul 16 14:32:01 server sshd[5802]: Failed password for invalid user root from 198.136.57.92 port 56112 ssh2
Jul 16 14:32:02 server sshd[5802]: Received disconnect from 198.136.57.92: 11: Bye Bye [preauth]
Jul 16 14:32:04 server sshd[5805]: reverse mapping checking getaddrinfo for 198-136-57-92.static.lvnoc.com [198.136.57.92] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 16 14:32:04 server sshd[5805]: User root from 198.136.57.92 not allowed because none of user's groups are listed in AllowGroups
Jul 16 14:32:04 server sshd[5805]: input_userauth_request: invalid user root [preauth]
Jul 16 14:32:04 server sshd[5805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.136.57.92  user=root
Jul 16 14:32:06 server sshd[5805]: Failed password for invalid user root from 198.136.57.92 port 57176 ssh2
Jul 16 14:32:06 server sshd[5805]: Received disconnect from 198.136.57.92: 11: Bye Bye [preauth]

Notice the timestamps on the left to see how often it is. According to the log, it had been happening for about a half an hour before I saw. Needless to say, I blocked their IP (198.136.57.92) in hosts.deny, but I’m wondering what exactly was happening here. Was it just a denial-of-service attack, or was it a POSSIBLE BREAK-IN ATTEMPT?

Improve this question
6
  • 7
    Welcome to the Internet. :)
    – Michael Hampton
    Jul 16, 2013 at 19:03
  • It's a crack attempt. As @MichaelHampton says, welcome to the Internet - this will keep happening.
    – Jenny D
    Jul 16, 2013 at 19:07
  • 3
    looks like Internet Background Radiation - Steve Gibson's term for these kinds of "spray-and-pray" cracking attempts.
    – nc4pk
    Jul 16, 2013 at 19:08
  • 1
    Somebody was trying to connect to your server through root I wouldn't consider a single connection a DOS attack.
    – Ramhound
    Jul 16, 2013 at 19:11
  • One login attempt every five seconds does not constitute a denial of service attack, unless your server is a Raspberry Pi (and probably not even then).
    – Daniel Beck ♦
    Jul 16, 2013 at 19:13

1 Answer 1

Reset to default
5

Well, POSSIBLE BREAK-IN ATTEMPT means that reverse DNS zone is not set correctly for IP address which was trying to connect; forward DNS record does not match reverse DNS record.

It looks like someone tried to bruteforce your server to get in using SSH.

I doubt it was DDoS using SSH.

Improve this answer
2
  • Okay thanks. I use a secure password that at even one attempt per second would take millions of years to brute force, and besides, I don't even allow SSH login as root. :-) Out of curiosity, if I were to set up a server, and not do anything to advertise it to search engines or anything, but have SSH accessible as root with a password like "password", how long would it be until someone hacked it?
    – Sparkette
    Jul 16, 2013 at 22:57
  • Well done on having strong password! Even if you are not advertising your server it will be found by hackers at some point. And if 'password' is your password it would be cracked soon since words like 'test', 'password', 'qwerty', etc are first once in the list to try. Once friend of mine set up a Linux computer with root password 123456. It was fresh install without any settings done and he forgot to change the password. It was connected to the Internet. Next day we found that someone got into computer as root via SSH and installed a virus. So, in his case it took one day to be cracked.
    – VL-80
    Jul 16, 2013 at 23:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .