2

I have a very weird situation. I've just created a new VM, it has been working for only 30 minutes and I'm seeing a strange activity in the auth.log:

Aug 10 16:52:35 ubuntu sshd[23186]: Failed password for root from 121.18.238.29 port 59064 ssh2
Aug 10 16:52:40 ubuntu sshd[23186]: message repeated 2 times: [ Failed password for root from 121.18.238.29 port 59064 ssh2]
Aug 10 16:52:40 ubuntu sshd[23186]: Received disconnect from 121.18.238.29 port 59064:11:  [preauth]
Aug 10 16:52:40 ubuntu sshd[23186]: Disconnected from 121.18.238.29 port 59064 [preauth]
Aug 10 16:52:40 ubuntu sshd[23186]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.29  user=root
Aug 10 16:52:41 ubuntu sshd[23188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.20  user=root
Aug 10 16:52:43 ubuntu sshd[23190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.29  user=root
Aug 10 16:52:43 ubuntu sshd[23188]: Failed password for root from 121.18.238.20 port 56100 ssh2
Aug 10 16:52:45 ubuntu sshd[23190]: Failed password for root from 121.18.238.29 port 39684 ssh2
Aug 10 16:52:47 ubuntu sshd[23188]: Failed password for root from 121.18.238.20 port 56100 ssh2
Aug 10 16:52:47 ubuntu sshd[23190]: Failed password for root from 121.18.238.29 port 39684 ssh2
Aug 10 16:52:50 ubuntu sshd[23190]: Failed password for root from 121.18.238.29 port 39684 ssh2
Aug 10 16:52:50 ubuntu sshd[23188]: Failed password for root from 121.18.238.20 port 56100 ssh2
Aug 10 16:52:50 ubuntu sshd[23190]: Received disconnect from 121.18.238.29 port 39684:11:  [preauth]
Aug 10 16:52:50 ubuntu sshd[23190]: Disconnected from 121.18.238.29 port 39684 [preauth]
Aug 10 16:52:50 ubuntu sshd[23190]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.29  user=root
Aug 10 16:52:50 ubuntu sshd[23188]: Received disconnect from 121.18.238.20 port 56100:11:  [preauth]
Aug 10 16:52:50 ubuntu sshd[23188]: Disconnected from 121.18.238.20 port 56100 [preauth]
Aug 10 16:52:50 ubuntu sshd[23188]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.20  user=root
Aug 10 16:52:52 ubuntu sshd[23196]: Did not receive identification string from 13.64.88.11
Aug 10 16:52:53 ubuntu sshd[23194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.20  user=root

I have only made an update/upgrade to the VM and added a new adm user. How can I be attacked so fast?

4

This is a common thing. 'Hackers' will be using a list of azure IPs and will attempt brute force SSH to gain access to your server. As the log above shows, only failures were made. Your IP was most likely unassigned from another Azure VM.

Nearly every sever I've setup online has this issue. There are two actions I recommend you do.

  1. Change your SSH port to something else, this greatly reduces your chances of attack.

  2. Install fail2ban. This will allow you to ban ip's for a set amount of time, or permanently when x number of authentications are made.

Also using Key only SSH improves security even more.

  • Fortunately this is just a test machine so is not critical, but thanks to this i now know that security never is enough.... from now on i will follow your recomendations on every vm, thanks... – Chico3001 Aug 10 '16 at 17:29
  • When changing a SSH port remember to close 22 on the firewall and open your new port (ints between 1024 and 65535). Having a firewall is always important too! iptables is what I use. – mt025 Aug 10 '16 at 17:31
  • +1 for fail2ban – Trevor Sullivan Nov 11 '18 at 22:33
0

You haven't been hacked yet, but someone is trying to get in.

you should implement Fail2Ban to temporarily block IPs after a set number of failed login attempts.

There is nothing about your situation that makes being "a new VM or adm user" meaningful. The attack is against the root account, and the VM is on an IP address that existed before it was assigned to the VM. Someone performed a port scan, noticed that the port was up, and then tried a distributed brute-force attack. Its likely that the former assignee of the IP address had SSH services as well, so you may be experiencing an attack that was already underway against a prior assignee. theres no way we can tell.

0

This is quite common situation and unfortunately will be happening constantly. These attempts are just bots probing whole classes of IPs at random and yours just came up 30 mins after you deployed your VM. I suggest installing fail2ban if it bothers you.

0

When you legitimately login to your remote host you should be using ssh keys to avoid using a password ... once that is true then disable allowing passwords on that remote host ... on your remote host edit

vi /etc/ssh/sshd_config

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes
PasswordAuthentication no

then while on remote host bounce its ssh daemon by issuing :

sudo service sshd restart

( and no it will not kill your ssh login session unless you are logged in using a password )

This change will preemptively thwart all login attempts which use a password and so those messages will stop

Failed password for root from 182.100.67.173 port 41144 ssh2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.