1

In my $ sudo lastb, I found so many lines of bad login attempts(?).
Are they all hacking attempts against my publicly accessible server? I just noticed that I had 881 times of bad login attempts for only one day (Feb. 24)
Look at my output of the $ sudo lastb command below:


$ sudo lastb
...
...
root     ssh:notty    116.31.116.33    Fri Feb 24 18:51 - 18:51  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:49 - 18:49  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:49 - 18:49  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:49 - 18:49  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:48 - 18:48  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:48 - 18:48  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:48 - 18:48  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:47 - 18:47  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:47 - 18:47  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:47 - 18:47  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:46 - 18:46  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:46 - 18:46  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:46 - 18:46  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:45 - 18:45  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:44 - 18:44  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:44 - 18:44  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:43 - 18:43  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:43 - 18:43  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:43 - 18:43  (00:00)
root     ssh:notty    179.85.126.212   Fri Feb 24 17:15 - 17:15  (00:00)
root     ssh:notty    179.85.126.212   Fri Feb 24 17:15 - 17:15  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
toor     ssh:notty    185.144.157.8    Fri Feb 24 15:37 - 15:37  (00:00)
toor     ssh:notty    185.144.157.8    Fri Feb 24 15:36 - 15:36  (00:00)

btmp begins Fri Feb 24 15:36:58 2017
[woogon@cafe24 ~]$ sudo lastb | wc -l
9743
[woogon@cafe24 ~]$ sudo lastb | grep Feb 24 | wc -l
grep: 24: No such file or directory
0
[woogon@cafe24 ~]$ sudo lastb | grep "Feb 24" | wc -l
881


What would be my defensive actions to this?

Thank you in advance.
Woogon

3
  • If you have a internet-facing system, this is expected.
    – muru
    Feb 28, 2017 at 15:16
  • You could additionally run grep sshd /var/log/auth.log to see the login attempts.
    – ridgy
    Feb 28, 2017 at 15:59
  • Hmmm. I feel like I am getting bloated with the log entries... Mar 1, 2017 at 13:50

2 Answers 2

0

I think the standard procedures here would be

A) Disable root ssh

and

B) Disable password authentication - use public key instead

To disable root ssh login, in /etc/ssh/sshd_config set PermitRootLogin no

There are plenty of tutorials that'll walk you through setting up public key authentication for ssh but it boils down to:

  1. Create a public/private key pair on your client machine with ssh-keygen
  2. Copy the public key to the server with ssh-copy-id
  3. In /etch/ssh/sshd_config (on your server) set PubkeyAuthentication yes
  4. Log in using the public key to verify it worked (if not check file permissions for /.ssh/ and /.ssh/authorized_keys, they usually give me trouble)
  5. In /etc/ssh/sshd_config set PasswordAuthentication no
0

Use the TCP Wrapper files /etc/hosts.allow and /etc/hosts.deny to limit ssh connections to specific FQDN or IP addresses.

The use of these files is described here.

https://www.lifewire.com/hostsdeny-linux-command-4094617

Be sure to include your local private network IP address range in /etc/hosts.allow so that you can continue to connect uninterrupted.

An example for allowing all IP addresses in the 192.168.0.* block would be:

ALL: 192.168.0.

Notice the trailing dot. That is the syntax for allowing all addresses in that range.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.