Recently a few friends and I came up with an idea for an app. To facilitate the creation of it, we set up LAMP on an Ubuntu Server 12.04. This box is running from my home. We've set up 3 user accounts. I'm still pretty new to Linux, but I have a bit of experience from using Ubuntu on my own box.

Today I was playing around with SSH and looking at the logs (I need to learn how to read that information to know how the server is performing, right?) and I saw the strangest thing.

In /var/log/auth.log and /var/log/auth.log.1 I saw a bunch of failed login attempts for 'root' and a few usernames I'm not familiar with. I looked over them and for as far as I can see no user has been authenticated except for the actual users on the system. A lot of the IP-addresses listed seem to be from Russia.

As of now this server contains nothing but a vanilla Ubuntu Server with LAMP, but even so, with the following command:

sudo grep -i fail /var/log/auth.log | wc -l

I get 3412 as a result. This seems very excessive for a server that has been up since April 8th. It gets worse, because running the above command on auth.log.1 returns 23075 (!!!!) results.

It seems obvious that people are trying to break into the server. Not that it contains anything of value, but once we start making progress on the app we wouldn't want our intellectual property stolen.

Should I be worried? And what can I do about it?


I found some very useful information here and this allowed me to run a script that splits and sorts all the invalid passwords and invalid users that tried to log in. May come in handy to someone who ended up here through Google!

  • 1
    Don't expose your computer directly to the Internet. Bot nets will be constantly trying to break into any open ports in this manner, be it SSH or HTTP. You need to firewall your computer and network. – dobey Apr 14 '14 at 19:02
  • Thank you. I'll do that, and let google be my friend. Got any tips, or can you point me in the right direction? – Raichu Apr 14 '14 at 19:06
  • And, do that fake account exist? – enedil Apr 14 '14 at 19:47
  • No, none of them do. It seems whoever (or whatever bot) is trying to log in is doing so with usernames like 'babu' and 'ashrae'. Weirdly specific. There's also some root login attempts but I believe Ubuntu disables that account in favor of sudo. – Raichu Apr 14 '14 at 19:49
  • @dobey in general I agree, but sometime you want the access to your computer from anywhere... so you have to bit the bullet. See my answer for counter-measures. – Rmano Apr 14 '14 at 23:40

This is happening a lot to me too. There are a lot of script kiddies trying brute force attacks against your SSH server.

My solution till now was to install DenyHosts, but seems that it will be not supported in 14.04; the next best solutions seems to be Fail2Ban. Links and more information in Package denyhosts in Ubuntu Trusty Tahr is deleted: temporary or forever?

In that answer, bodhi.zazen pointed to this highly recommended page: http://bodhizazen.com/Tutorials/SSH_security

| improve this answer | |
  • Great, I'll mark it as solved! Thanks for the information, I'll have a look. – Raichu Apr 14 '14 at 23:50
  • What about a firewall? That won't exactly help much for ssh, but it's important on a server. – Seth Apr 15 '14 at 2:49
  • @Seth Well, if you have a server you can't block incoming connection. At least, not on the services you want to offer. So security is important; the article on hardening the server by bodhi.zazen is worth reading. – Rmano Apr 15 '14 at 4:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.