0

I recently configured my external-facing router to forward traffic to port 22 on one machine on my LAN. SSHD is the only service listening on port 22.

Immediately I received traffic from IP addresses such as 36.156.24.97 and 223.111.139.210, which according to IP identification websites, have tried to make unauthorized login attempts on thousands of different machines.

When I reviewed /var/log/auth.log, I saw entries saying that my machine Received disconnect from 223.111.139.210. I expected to see logs detailing failed login attempts, or more detailed information.

I am running Debian.

Does anyone have any conjectures regarding what those remote machines were trying to do?

Improve this question
1

1 Answer 1

Reset to default
0

Does anyone have any conjectures regarding what those remote machines were trying to do?

Attempting to connect to any open 22 port that'll take them and trying default/common credentials in order to gain access, most likely.

It's rarely a good idea to leave 22 open to the world. If you do, ensure you're taking security measures (whitelists/PKI/fail2ban/etc) and have a good reason to do so. Obfuscating your ssh port is useful, but not anything close to "secure", so pair that with the other measures if you must.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .