I just looked at the message log

vi var/log/message2

I am getting a huge number of failed ssh attempts from China, e.g.

Mar 27 06:30:42 xxx sshd[10628]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=  user=root
Mar 27 06:30:46 xxx sshd[10632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=  user=root
Mar 27 06:30:47 xxx sshd[10632]: Failed password for root from port 45033 ssh2
Mar 27 06:30:53 xxx sshd[10632]: last message repeated 2 times

We don't offer our service to China

Does this mean that someone in China is trying to hack into our server?


Short answer, yes.

Long answer, yes, someone is attempting to login to your server. You'll see many of these attempts from all around the world. It's quite common and isn't necessarily a targeted attack.

There are a number of things to do that could prevent this from occurring. The simplest is, if you don't need SSH from everyone around the world, block/firewall it. If you want to keep access open, you should at least look to harden the service. Actually, either way, if you tighten it up, you should still look to increase security.

This looks like a good resource to start with. Your mileage may vary...

Top 20 OpenSSH Server Best Security Practices

  • any ideas why? Is it just common password attacks? – SeanJ Mar 29 '16 at 21:37
  • It's typical for them to scan networks for open ports, then once they find open ssh ports (in this case), then they will try simple auth attacks. Obviously this isn't all encompassing but a simple explanation on how those entries end up in your log. – user508889 Mar 29 '16 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.