ssh attack attempts on OS X 10.10 -- should I worry/respond?

Question

If I turn on OS X "Remote Login" (i.e., ssh access), my console log gets regular messages like the following:

 22/04/2015 13:05:23.364 sshd[2118]: error: PAM: authentication error for root from 43.255.190.157 via 10.0.1.10

These occur about once a second for long periods of time. The IP address of the attacker changes from time to time (but it usually stays at something like 43.255.190.* for a while). Turning off ssh access stops the attacks for a few minutes, but they usually restart within a little of while if restarting Remote Login (which I do need!).

I am not particularly worried about the actual attack succeeding (in particular, I've got the root account turned off) but should I be worried about excess network traffic and just filling up the log files with un-necessary crap? I would strongly prefer not to have to use any third-party software if possible.

My machine is behind a cable modem and Apple Time Capsule which does all the NAT stuff and forwards appropriate ports to this machine.

For what it's worth, under Mavericks /etc/hosts.deny doesn't seem to have any effect, but I understand that I could possibly use pfctl?

(I've got a similar question about VNC attacks...)

Answer 1

No real need to worry, as this is the usual "internet background noise".

If you want to get rid of those "attackers" have a look at fail2ban (even if it is 3rd party - its available via Homebrew and MacPorts and can also be applied to vnc). hosts.deny and therefore e.g. denyhosts are known to now work with sshd in mavericks anymore.

Answer 2

The reason you're getting this is because people have port scanners and other software that searches for open SSH addresses and then tries to log in with default usernames and passwords such as admin and 12345. If you can deal with the extra traffic and notifications, there is nothing to worry about. If you don't like it you could try opening SSH to another port, such as 796.