0

If I turn on OS X "Remote Login" (i.e., ssh access), my console log gets regular messages like the following:

 22/04/2015 13:05:23.364 sshd[2118]: error: PAM: authentication error for root from 43.255.190.157 via 10.0.1.10

These occur about once a second for long periods of time. The IP address of the attacker changes from time to time (but it usually stays at something like 43.255.190.* for a while). Turning off ssh access stops the attacks for a few minutes, but they usually restart within a little of while if restarting Remote Login (which I do need!).

I am not particularly worried about the actual attack succeeding (in particular, I've got the root account turned off) but should I be worried about excess network traffic and just filling up the log files with un-necessary crap? I would strongly prefer not to have to use any third-party software if possible.

My machine is behind a cable modem and Apple Time Capsule which does all the NAT stuff and forwards appropriate ports to this machine.

For what it's worth, under Mavericks /etc/hosts.deny doesn't seem to have any effect, but I understand that I could possibly use pfctl?

(I've got a similar question about VNC attacks...)

Improve this question
1
3

No real need to worry, as this is the usual "internet background noise".

If you want to get rid of those "attackers" have a look at fail2ban (even if it is 3rd party - its available via Homebrew and MacPorts and can also be applied to vnc). hosts.deny and therefore e.g. denyhosts are known to now work with sshd in mavericks anymore.

Improve this answer
2
  • The answer to this question has this excellent suggestion and more superuser.com/q/244214/370177 – fswings Apr 23 '15 at 13:39
  • I just got my router ignore port 22 but to forward a different port from the internet to port 22 on the machine I want to access. This type of thing also would allow you to access multiple machines on your home network: port 2201 goes to port 22 on machine #1, 2202 goes to port 22 on machine #2, etc. It provides no real increase in secuity but it is simple and decreases the noise in the log files. – j-beda Sep 12 '17 at 19:40
0

The reason you're getting this is because people have port scanners and other software that searches for open SSH addresses and then tries to log in with default usernames and passwords such as admin and 12345. If you can deal with the extra traffic and notifications, there is nothing to worry about. If you don't like it you could try opening SSH to another port, such as 796.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.