1

I just looked at the message log

vi var/log/message2

I am getting a huge number of failed ssh attempts from China, e.g. 

Mar 27 06:30:42 xxx sshd[10628]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.211.244  user=root
Mar 27 06:30:46 xxx sshd[10632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.211.244  user=root
Mar 27 06:30:47 xxx sshd[10632]: Failed password for root from 58.218.211.244 port 45033 ssh2
Mar 27 06:30:53 xxx sshd[10632]: last message repeated 2 times

We don't offer our service to China

Does this mean that someone in China is trying to hack into our server?

Improve this question

1 Answer 1

Reset to default
2

Short answer, yes.

Long answer, yes, someone is attempting to login to your server. You'll see many of these attempts from all around the world. It's quite common and isn't necessarily a targeted attack.

There are a number of things to do that could prevent this from occurring. The simplest is, if you don't need SSH from everyone around the world, block/firewall it. If you want to keep access open, you should at least look to harden the service. Actually, either way, if you tighten it up, you should still look to increase security.

This looks like a good resource to start with. Your mileage may vary...

Top 20 OpenSSH Server Best Security Practices

Improve this answer
2
  • any ideas why? Is it just common password attacks?
    – SeanJ
    Mar 29, 2016 at 21:37
  • It's typical for them to scan networks for open ports, then once they find open ssh ports (in this case), then they will try simple auth attacks. Obviously this isn't all encompassing but a simple explanation on how those entries end up in your log.
    – user508889
    Mar 29, 2016 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .