Potential SSH security problem?

Question

I just did a 'netstat -a' on my FreeBSD machine. I discovered the following:

Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 40 turban.ssh host90.embarqser.60230 ESTABLISHED
tcp4 0 0 turban.ssh host90.embarqser.59985 LAST_ACK
tcp4 0 0 turban.ssh host90.embarqser.47224 TIME_WAIT
tcp4 0 0 turban.ssh host90.embarqser.9304 LAST_ACK

Could there be someone intruding my machine? My hostname is 'turban' as you can see. I'm really 'new' about system security. Could someone enlighten me?

From /var/log/auth.log, a lot of errors like:

May 4 20:07:10 turban sshd[47801]: Failed keyboard-interactive/pam for invalid user backup from 76.7.43.90 port 11831 ssh2

May 4 20:07:13 turban sshd[47804]: error: PAM: authentication error for bin from 76.7.43.90...

Answer 1

Look at /var/auth.log for more information.

If someone is trying to access to your machine is loged in this file.

Example from my auth.log:

Apr 24 13:53:16 my-server sshd[8107]: Failed password for invalid user db2 from 123.123.123.123 port 59167 ssh2

To see IP of connected (SSH connections) users type this:

netstat -atn | egrep '(:22)' | egrep -v '(:::|0.0.0.0)' | awk '{print substr($5,0,length($5)-5)}' | sort | uniq -c

This will show you IP and number of connection/IP

Answer 2

The short answer is that someone is trying to break into your system, most likely via a variation on the typical dictionary attack (i.e. by trying common username/password combinations, instead of just randomly guessing).

In addition to the excellent advice from @Henk (I create a specific group, usually sshusers, and only permit users in that group to log in, for example), I would suggest installing Fail2ban on your system with an SSH jail set up. This will elevate the difficulty of a brute-force attack against your server to the realm of nigh impossibility, since attackers will find themselves suddenly shut off for a period of time when they try; combine this with the how-to entitled Fail2ban monitoring Fail2ban to create an elevated response to an attack (mine's set up with the default 10 minute ban initially, and then a full week if they're persistent), and you can just stop worrying altogether (provided you have at least adequately strong passwords; use pubkeys instead and you're all but invincible!).

Answer 3

I would not worry too much about this specific discovery. Maybe somebody did try to "port-knock port-scan" on your SSH-port (e.g. with a dictionary scanner), but didn't succeed since you hopefully have a proper password or auth-key only.

To brighten your knowledge, read this blogpost Improve SSH Remote Access Security to see what else you can do, esp. the part "Allow Only Specific User to Log In by SSH". And do not allow root logins through SSH!

Answer 4

My logs are full of russians, americans trying English names on my 22nd port. Too bad for them I moved SSH port to 307, and I use port-knocking on port 54321 to open the SSH port.