0

I have this disturbing message in my sshd log:

Jun 01 00:39:00 redy sshd[7856]: Accepted publickey for mgara from 127.0.0.1 port 34732 ssh2: RSA SHA256:ymHGJgkw9wZp6E5d/LudMza4rAeacI4mdyj/oMLgPJE
Jun 01 00:38:58 redy sshd[7846]: Did not receive identification string from 127.0.0.1 port 34730
Jun 01 00:38:58 redy sshd[7845]: Did not receive identification string from 127.0.0.1 port 34728
Jun 01 00:38:58 redy sshd[7844]: Server listening on :: port 7022.
Jun 01 00:38:58 redy sshd[7844]: Server listening on 0.0.0.0 port 7022.
Jun 01 00:38:57 redy sshd[7794]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.198.144  user=root

which is disturbing me because I have no publickeys set up to be authorized, nor did I attempt to anyway access my computer at this time. For example my .ssh folder is empty.

[mgara@redy ~]$ ls ~/.ssh
known_hosts

Does this mean that my computer is being logged into through ssh by some potentially malicious attacker?

My understanding is that 127.0.0.1 is localhost, meaning my computer, which doesn't make sense to me. Is this some benign/expected behaviour of sshd, or is this somekind of clever attacker logging in by spoofing his ip address to localhost?

Are there any steps I can take to further investigate this if necessary, and if it is a compromise address it?

I currently have sshd running on port 22, and I have fail2ban running as my computer gets constantly bombarded with login attempts.

Edit

I've since turned off sshd:

[mgara@redy ~]$ sudo service sshd status
Redirecting to /bin/systemctl status  sshd.service
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; disabled; vendor preset: disabled)
   Active: inactive (dead) since Thu 2017-06-01 12:22:59 PDT; 22h ago
   Docs: man:sshd(8)
       man:sshd_config(5)
Main PID: 966 (code=exited, status=0/SUCCESS)

Jun 01 11:48:53 redy sshd[15527]: Received disconnect from 101.66.253.100 port 45742:11: Bye Bye [preauth]
Jun 01 12:08:14 redy sshd[21037]: Invalid user support from 103.207.38.167 port 56463
Jun 01 12:08:14 redy sshd[21037]: input_userauth_request: invalid user support [preauth]
Jun 01 12:08:15 redy sshd[21037]: pam_unix(sshd:auth): check pass; user unknown
Jun 01 12:08:15 redy sshd[21037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.207.38.167
Jun 01 12:08:17 redy sshd[21037]: Failed password for invalid user support from 103.207.38.167 port 56463 ssh2
Jun 01 12:08:17 redy sshd[21037]: error: Received disconnect from 103.207.38.167 port 56463:3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Jun 01 12:08:17 redy sshd[21037]: Disconnected from 103.207.38.167 port 56463 [preauth]
Jun 01 12:22:59 redy systemd[1]: Stopping OpenSSH server daemon...
Jun 01 12:22:59 redy systemd[1]: Stopped OpenSSH server daemon.

but I still have log messages that date later than stopping sshd!

Jun 01 19:41:53 redy sshd[24602]: Accepted publickey for mgara from 127.0.0.1 port 42700 ssh2: RSA SHA256:oTJuUm8APxMB0nHOKhAo+mdnM5L59g+7kxy7TzsdNp0
Jun 01 19:41:47 redy sshd[24581]: Did not receive identification string from 127.0.0.1 port 42698
Jun 01 12:26:26 redy sshd[26552]: Accepted publickey for mgara from 127.0.0.1 port 38096 ssh2: RSA SHA256:bBBPSge3eFEDWY50mjvOjQgYRSqiN6/qy+jlewBLdGA
Jun 01 12:26:24 redy sshd[26542]: Did not receive identification string from 127.0.0.1 port 38094
Jun 01 12:26:24 redy sshd[26541]: Did not receive identification string from 127.0.0.1 port 38092
Jun 01 12:26:24 redy sshd[26540]: Server listening on :: port 7022.
Jun 01 12:26:24 redy sshd[26540]: Server listening on 0.0.0.0 port 7022.
Jun 01 12:26:02 redy sshd[7844]: Received signal 15; terminating.

My ssh_config is the default one that comes with Fedora 25.

2 Answers 2

0

127.0.0.1 is a localhost. You can have the authorized_keys configured in some other place -- have a look into the sshd_config.

0

For the benefit of anyone else who has seen this weird behaviour and can't figure it out, in my case, it was the x2go server. Turning sshd off does not disable the x2go server and it will still apparently attempt to establish connections with localhost intermittently. For me it was enough to turn off, disable x2go and the messages went away.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .