A few weeks ago I posted a question here about some ssh
issues I was having with an Ubuntu 12.04 box. Fast forward to today and I am trying to allow someone else access to the machine, but they keep getting password errors. I checkout out var/logs/auth.log
for more info, and found this:
May 11 19:45:33 myserver sshd[9264]: Did not receive identification string from 211.110.xxx.x
May 11 19:45:38 myserver sshd[9267]: Did not receive identification string from 211.110.xxx.x
May 11 19:45:44 myserver sshd[9270]: Did not receive identification string from 211.110.xxx.x
May 11 19:45:49 myserver sshd[9274]: Did not receive identification string from 211.110.xxx.x
I have almost 10000 lines that all seem to say more or less the same thing (there are also 4 auth.log.gz files, which I'm assuming are more of the same?). Sometimes there is a random username attached to the request, input_userauth_request: invalid user bash [preauth]
I don't know much about servers, but it looks like someone is trying to gain access to mine.
Googled around for how to block an IP address in Ubuntu and ended up with this: iptables -A INPUT -s 211.110.xxx.x -j DROP
, but after running that command and checking the logs, I'm still getting requests from this one IP every 5 seconds.
How can I find out more about what's going on and deal with these constant requests?