3

I'm pretty new here. I was looking at my system logs and noticed this:

Jul 21 00:57:47 htpc sshd[13001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.120.248.13  user=root
Jul 21 00:57:49 htpc sshd[13001]: Failed password for root from 188.120.248.13 port 56899 ssh2
Jul 21 00:57:49 htpc sshd[13001]: Received disconnect from 188.120.248.13: 11: Bye Bye [preauth]
Jul 21 00:57:52 htpc sshd[13003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.120.248.13  user=root
Jul 21 00:57:54 htpc sshd[13003]: Failed password for root from 188.120.248.13 port 54709 ssh2
Jul 21 00:57:54 htpc sshd[13003]: Received disconnect from 188.120.248.13: 11: Bye Bye [preauth]
Jul 21 00:57:57 htpc sshd[13005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.120.248.13  user=root
Jul 21 00:57:58 htpc sshd[13005]: Failed password for root from 188.120.248.13 port 59488 ssh2
Jul 21 00:57:58 htpc sshd[13005]: Received disconnect from 188.120.248.13: 11: Bye Bye [preauth]

It just keeps going. Does anyone know what it is exactly?

Thanks in advance.

3

Robots trying to guess your password. When you have public IP and running service on open port, they are trying all the time.

If you are not specially targeted and have reasonably strong passwords or disabled password authentication, they are harmless. It is just eating your processor time.

You can fight with this by hiding your service to different port, by hiding it behind some port-knocking service (fwknop), or ban these requests on-the fly using fail2ban.

2

This looks like repeated attempts to log in as the root user via ssh, whether it's a real person or a bot is not clear, or particularly relevant. Reverse checking the IP shows that it's coming from Russia.

It's not a good idea to be able to ssh into your system as root for precisely this reason. Of course, if you've already denied access, or not activated the root user password, they won't be able to get in anyway! There are loads of botnets on the internet, searching for open ports and trying to crack the passwords. If the password is found, and the root user can login via ssh, total control of your system will be handed over to the baddies!

A good way to nip this in the bud is to deny root access via ssh, by adding a line to the file found at /etc/ssh/sshd_config. The following line would be useful to add:

DenyUsers root

And/or

PermitRootLogin no

Make the ssh service reload your changes with:

sudo service ssh restart

A great link about hardening your ssh server can be found here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.