I have this disturbing message in my sshd log:
Jun 01 00:39:00 redy sshd[7856]: Accepted publickey for mgara from 127.0.0.1 port 34732 ssh2: RSA SHA256:ymHGJgkw9wZp6E5d/LudMza4rAeacI4mdyj/oMLgPJE
Jun 01 00:38:58 redy sshd[7846]: Did not receive identification string from 127.0.0.1 port 34730
Jun 01 00:38:58 redy sshd[7845]: Did not receive identification string from 127.0.0.1 port 34728
Jun 01 00:38:58 redy sshd[7844]: Server listening on :: port 7022.
Jun 01 00:38:58 redy sshd[7844]: Server listening on 0.0.0.0 port 7022.
Jun 01 00:38:57 redy sshd[7794]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.198.144 user=root
which is disturbing me because I have no publickeys set up to be authorized, nor did I attempt to anyway access my computer at this time. For example my .ssh
folder is empty.
[mgara@redy ~]$ ls ~/.ssh
known_hosts
Does this mean that my computer is being logged into through ssh by some potentially malicious attacker?
My understanding is that 127.0.0.1
is localhost, meaning my computer, which doesn't make sense to me. Is this some benign/expected behaviour of sshd, or is this somekind of clever attacker logging in by spoofing his ip address to localhost?
Are there any steps I can take to further investigate this if necessary, and if it is a compromise address it?
I currently have sshd running on port 22, and I have fail2ban running as my computer gets constantly bombarded with login attempts.
Edit
I've since turned off sshd:
[mgara@redy ~]$ sudo service sshd status
Redirecting to /bin/systemctl status sshd.service
● sshd.service - OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; disabled; vendor preset: disabled)
Active: inactive (dead) since Thu 2017-06-01 12:22:59 PDT; 22h ago
Docs: man:sshd(8)
man:sshd_config(5)
Main PID: 966 (code=exited, status=0/SUCCESS)
Jun 01 11:48:53 redy sshd[15527]: Received disconnect from 101.66.253.100 port 45742:11: Bye Bye [preauth]
Jun 01 12:08:14 redy sshd[21037]: Invalid user support from 103.207.38.167 port 56463
Jun 01 12:08:14 redy sshd[21037]: input_userauth_request: invalid user support [preauth]
Jun 01 12:08:15 redy sshd[21037]: pam_unix(sshd:auth): check pass; user unknown
Jun 01 12:08:15 redy sshd[21037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.207.38.167
Jun 01 12:08:17 redy sshd[21037]: Failed password for invalid user support from 103.207.38.167 port 56463 ssh2
Jun 01 12:08:17 redy sshd[21037]: error: Received disconnect from 103.207.38.167 port 56463:3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Jun 01 12:08:17 redy sshd[21037]: Disconnected from 103.207.38.167 port 56463 [preauth]
Jun 01 12:22:59 redy systemd[1]: Stopping OpenSSH server daemon...
Jun 01 12:22:59 redy systemd[1]: Stopped OpenSSH server daemon.
but I still have log messages that date later than stopping sshd!
Jun 01 19:41:53 redy sshd[24602]: Accepted publickey for mgara from 127.0.0.1 port 42700 ssh2: RSA SHA256:oTJuUm8APxMB0nHOKhAo+mdnM5L59g+7kxy7TzsdNp0
Jun 01 19:41:47 redy sshd[24581]: Did not receive identification string from 127.0.0.1 port 42698
Jun 01 12:26:26 redy sshd[26552]: Accepted publickey for mgara from 127.0.0.1 port 38096 ssh2: RSA SHA256:bBBPSge3eFEDWY50mjvOjQgYRSqiN6/qy+jlewBLdGA
Jun 01 12:26:24 redy sshd[26542]: Did not receive identification string from 127.0.0.1 port 38094
Jun 01 12:26:24 redy sshd[26541]: Did not receive identification string from 127.0.0.1 port 38092
Jun 01 12:26:24 redy sshd[26540]: Server listening on :: port 7022.
Jun 01 12:26:24 redy sshd[26540]: Server listening on 0.0.0.0 port 7022.
Jun 01 12:26:02 redy sshd[7844]: Received signal 15; terminating.
My ssh_config is the default one that comes with Fedora 25.