2

I was looking into my log files on my server and I found the following lines in: /var/log/.auth.log.1:

pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruse      r= rhost=218.87.109.156  user=root
Failed password for root from 218.87.109.156 port 7612 ssh2
message repeated 5 times: [ Failed password for root from 218.87.109.156 port 7      612 ssh2]
error: maximum authentication attempts exceeded for root from 218.87.109.156 po      rt 7612 ssh2 [preauth]
Disconnecting: Too many authentication failures [preauth]
PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=      218.87.109.156  user=root
PAM service(sshd) ignoring max retries; 6 > 3
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruse      r= rhost=218.87.109.156  user=root
Failed password for root from 218.87.109.156 port 50092 ssh2
message repeated 5 times: [ Failed password for root from 218.87.109.156 port 5      0092 ssh2]
Failed password for invalid user service from 188.187.119.158 port 52722 ssh2
pam_unix(sshd:auth): check pass; user unknown
Failed password for root from 113.195.145.79 port 6500 ssh2
Received disconnect from 121.18.238.39 port 58070:11:  [preauth]
Failed password for root from 121.18.238.119 port 57538 ssh2
Failed password for root from 121.18.238.39 port 57268 ssh2
Failed password for root from 121.18.238.106 port 34360 ssh2
Disconnected from 92.222.216.31 port 58960 [preauth]
Invalid user truman from 92.222.216.31
Received disconnect from 92.222.216.31 port 33922:11: Normal Shutdown, Thank you       for playing [preauth]
input_userauth_request: invalid user truman [preauth]

And it keeps going on like this for thousands of lines!

And also somewhere I have:

Nov 30 13:17:01 Aran CRON[6038]: pam_unix(cron:session): session opened for user root by (uid=0)

What does CRON mean in here? so can somebody please explain to me what are these logs? Am I in danger? what should I do to get myself more secure?

2

This answer doesn't really answer who is trying to log into your host, but it can give you an idea of where the person is coming from.

If you're going to use passwords for logging in through ssh, you should take some precautions as to people trying to hack into your system. For my personal use I like to use fail2ban and then I wrote my own script that uses iptables and ipset. The latter part I use for complete blocking of country IPs from coming in to my host on port 22. I have also installed geoiplookup as a way to see where the IP is coming from to decide if I want to block the country or not. The script I have below obtains the sets of IPs from ipdeny.com. It has drastically reduced the amount of attempts on my host since I leave port 22 open most of the time.


Installing fail2ban:

sudo apt install fail2ban

Usually with fail2ban the default settings are OK. If you want to change them make sure to copy /etc/fail2ban/jail.conf as /etc/fail2ban/jail.local and make the modifications to the jail.local file you have created. You can also see failed attempts in the /var/log/fail2ban.log file.


Installing geoiplookup:

sudo apt install geoip-bin

Then you can see where the IP addresses are coming from.

~$ geoiplookup 218.87.109.156
GeoIP Country Edition: CN, China

The country blocking script that I created.

A required application for the country block is ipset. This application allows iptables to use a block of IPs instead of showing every individual IP address when you check the status of iptables.

sudo apt install ipset

I am certain that there is a lot that can be cleaned up. I put mine in my home folder and called it country_block.bsh. Since the script makes changes to iptables it has to be called from sudo. I did add the check into the script.

#!/bin/bash

function custom(){
    echo "Removing CUSTOM_IP set..."
    prts=$(iptables -nvL INPUT | grep "CUSTOM_IP" | awk '{print $15}')
    iptables -D INPUT -p tcp -m set --match-set CUSTOM_IP src -m multiport --dport ${prts} -j DROP 2>/dev/null
    ipset destroy CUSTOM_IP
    ipset -N CUSTOM_IP hash:net
    echo "Creating CUSTOM_IP set..."
    for i in $(cat custom.zone); do ipset -A CUSTOM_IP $i; done
    echo "Creating rules for CUSTOM_IP set..."
    iptables -A INPUT -p tcp -m set --match-set CUSTOM_IP src -m multiport --dports ${ports} -j DROP
}

function tablecheck(){
    iptables -S INPUT | grep -v ACCEPT 
}

# Check for ipset
which ipset >/dev/null
case $? in
1) echo "ipset not found on system.  Please install ipset application."
exit 1;;
0);;
esac


# Check for root
if [ "$EUID" -ne 0 ]; then
  echo "Please run this script as root"
  exit 1
fi

# Set ports
ports=22,10000

# Check for country codes, if none, print list.
if [[ $@ == "" ]]; then
    curl http://www.ipdeny.com/ipblocks/ 2>/dev/null | grep "<td>" | awk -F'<p>' '{print $2}' | awk -F'[' '{print $1}' | grep -v -e '^$'
    echo "Choose any of the countries by typing in the two letter code between the ( )."
    exit
fi

if [[ $1 == "custom" ]]; then
    if [ ! -f custom.zone ]; then
        echo "Missing custom.zone file.  Please create custom.zone file with IP addresses for blocking."
        exit
    fi
    custom
    tablecheck
    exit
fi


#Set ISO to country code(s).
ISO=$@

#Start Loop for country IP blocks and creating IPTABLES chain(s).
for c in $ISO; do

    #Convert to lowercase.  If already lowercase, ignored.
    c=$(echo $c | awk '{print tolower($0)}')
    #Match code to country name
    country=$(curl http://www.ipdeny.com/ipblocks/ 2>/dev/null | grep \($(echo $c | awk '{print toupper($0)}')\) | awk -F'<p>' '{print $2}' | awk -F'(' '{print $1}' | sed 's/ //g' | sed 's/,//g')

    # Truncate to 31 characters if too long.
    country=${country:0:31}
    echo "Got country $country..."

    echo "Removing Existing Rule for $country (if any)..."
    prts=$(iptables -nvL INPUT | grep "$country" | awk '{print $15}')
    iptables -D INPUT -p tcp -m set --match-set "$country" src -m multiport --dport ${prts} -j DROP 2>/dev/null
    ipset destroy $country
    ipset -N $country hash:net
    rm $c.zone 2>/dev/null

    echo "Downloading IP block for $country..."
    wget -P . http://www.ipdeny.com/ipblocks/data/countries/$c.zone 2>/dev/null
    echo "Checking for invalid IP ranges in $country zone..."
    for i in $(seq 1 7); do grep "/$i$" $c.zone; if [[ $? == "0" ]]; then sed -i "s/\/${i}$/\/24/" $c.zone; echo "Fixed..."; fi; done
    echo "Creating iptable block for $country..."
    for i in $(cat $c.zone); do ipset -A "$country" $i; done

    echo "Adding rule to firewall..."
    iptables -A INPUT -p tcp -m set --match-set "$country" src -m multiport --dports ${ports} -j DROP

    echo "Added Firewall Rule for $country"
    rm $c.zone 2>/dev/null
done

if [[ $# == "1" || $1 -ne "custom" ]]; then
    tablecheck
else
    if [ ! -f custom.zone ]; then
        echo "Missing custom.zone file.  Please create custom.zone file with IP addresses for blocking."
        tablecheck
        exit
    fi
    custom
fi

if [[ $# -ne "1" ]]; then
    tablecheck
fi

#iptables -S INPUT | grep -v ACCEPT 

You can then create a custom.zone in the same folder as the country_block.bsh file with just IPs that might be trying over and over again to hack your system. Add them with a /32 at the end of the IP address like 256.99.265.106/32. After you add your own custom IPs, you can reload them in simply by running:

sudo ./country_block.bsh custom

Be careful not to block your own country or your own public IP.

Also be careful not to block any other ports that are not open. If you block port 80, there is a chance that if you visit a website from that country it will not load because it cannot return to your system on port 80.

Then I created another script in my home folder called cb_update.bsh that contains all the countries I want to block.

#!/bin/bash

cd /home/terrance/scripts/
./country_block.bsh cn ru nl de dk fr id ie it kr sg tw vn br ua pt il gb jp pk ar co fi in

Then I added the following lines to my /etc/crontab file. It covers every time my system reboots and it updates the list at 01:05 in the morning.

$ cat /etc/crontab

@reboot     root    /bin/bash -c 'sleep 20 && /home/terrance/cb_update.bsh'
01 05   * * *   root    /home/terrance/cb_update.bsh

If you run the script by itself, it will give you the country codes:

terrance@terrance-ubuntu:~/scripts$ sudo ./country_block.bsh 
AFGHANISTAN (AF) 
LAND ISLANDS (AX) 
ALBANIA (AL) 
ALGERIA (DZ) 
AMERICAN SAMOA (AS) 
ANDORRA (AD) 
ANGOLA (AO) 
ANGUILLA (AI) 
ANTIGUA AND BARBUDA (AG) 
ARGENTINA (AR) 
ARMENIA (AM) 
ARUBA (AW) 
AUSTRALIA (AU) 
AUSTRIA (AT) 
AZERBAIJAN (AZ) 
BAHAMAS (BS) 
BAHRAIN (BH) 
BANGLADESH (BD) 
BARBADOS (BB) 
BELARUS (BY) 
BELGIUM (BE) 
BELIZE (BZ) 
BENIN (BJ) 
BERMUDA (BM) 
BHUTAN (BT) 
BOLIVIA (BO) 
BOSNIA AND HERZEGOVINA (BA) 
BOTSWANA (BW) 
BRAZIL (BR) 
BRITISH INDIAN OCEAN TERRITORY (IO) 
BRUNEI DARUSSALAM (BN) 
BULGARIA (BG) 
BURKINA FASO (BF) 
BURUNDI (BI) 
CAMBODIA (KH) 
CAMEROON (CM) 
CANADA (CA) 
CAPE VERDE (CV) 
CAYMAN ISLANDS (KY) 
CENTRAL AFRICAN REPUBLIC (CF) 
CHAD (TD) 
CHILE (CL) 
CHINA (CN) 
COLOMBIA (CO) 
COMOROS (KM) 
CONGO (CG) 
CONGO, THE DEMOCRATIC REPUBLIC OF THE (CD) 
COOK ISLANDS (CK) 
COSTA RICA (CR) 
COTE D'IVOIRE (CI) 
CROATIA (HR) 
CUBA (CU) 
CYPRUS (CY) 
CZECH REPUBLIC (CZ) 
DENMARK (DK) 
DJIBOUTI (DJ) 
DOMINICA (DM) 
DOMINICAN REPUBLIC (DO) 
ECUADOR (EC) 
EGYPT (EG) 
EL SALVADOR (SV) 
EQUATORIAL GUINEA (GQ) 
ERITREA (ER) 
ESTONIA (EE) 
ETHIOPIA (ET) 
FAROE ISLANDS (FO) 
FIJI (FJ) 
FINLAND (FI) 
FRANCE (FR) 
FRENCH GUIANA (GF) 
FRENCH POLYNESIA (PF) 
GABON (GA) 
GAMBIA (GM) 
GEORGIA (GE) 
GERMANY (DE) 
GHANA (GH) 
GIBRALTAR (GI) 
GREECE (GR) 
GREENLAND (GL) 
GRENADA (GD) 
GUADELOUPE (GP) 
GUAM (GU) 
GUATEMALA (GT) 
GUINEA (GN) 
GUINEA-BISSAU (GW) 
GUYANA (GY) 
HAITI (HT) 
HOLY SEE (VATICAN CITY STATE) (VA) 
HONDURAS (HN) 
HONG KONG (HK) 
HUNGARY (HU) 
ICELAND (IS) 
INDIA (IN) 
INDONESIA (ID) 
IRAN, ISLAMIC REPUBLIC OF (IR) 
IRAQ (IQ) 
IRELAND (IE) 
ISLE OF MAN (IM) 
ISRAEL (IL) 
ITALY (IT) 
JAMAICA (JM) 
JAPAN (JP) 
JERSEY (JE) 
JORDAN (JO) 
KAZAKHSTAN (KZ) 
KENYA (KE) 
KIRIBATI (KI) 
KOREA, DEMOCRATIC PEOPLE'S REPUBLIC OF (KP) 
KOREA, REPUBLIC OF (KR) 
KUWAIT (KW) 
KYRGYZSTAN (KG) 
LAO PEOPLE'S DEMOCRATIC REPUBLIC (LA) 
LATVIA (LV) 
LEBANON (LB) 
LESOTHO (LS) 
LIBERIA (LR) 
LIBYAN ARAB JAMAHIRIYA (LY) 
LIECHTENSTEIN (LI) 
LITHUANIA (LT) 
LUXEMBOURG (LU) 
MACAO (MO) 
MACEDONIA, THE FORMER YUGOSLAV REPUBLIC OF (MK) 
MADAGASCAR (MG) 
MALAWI (MW) 
MALAYSIA (MY) 
MALDIVES (MV) 
MALI (ML) 
MALTA (MT) 
MARSHALL ISLANDS (MH) 
MARTINIQUE (MQ) 
MAURITANIA (MR) 
MAURITIUS (MU) 
MAYOTTE (YT) 
MEXICO (MX) 
MICRONESIA, FEDERATED STATES OF (FM) 
MOLDOVA, REPUBLIC OF (MD) 
MONACO (MC) 
MONGOLIA (MN) 
MONTENEGRO (ME) 
MONTSERRAT (MS) 
MOROCCO (MA) 
MOZAMBIQUE (MZ) 
MYANMAR (MM) 
NAMIBIA (NA) 
NAURU (NR) 
NEPAL (NP) 
NETHERLANDS (NL) 
NEW CALEDONIA (NC) 
NEW ZEALAND (NZ) 
NICARAGUA (NI) 
NIGER (NE) 
NIGERIA (NG) 
NIUE (NU) 
NORFOLK ISLAND (NF) 
NORTHERN MARIANA ISLANDS (MP) 
NORWAY (NO) 
OMAN (OM) 
PAKISTAN (PK) 
PALAU (PW) 
PALESTINIAN TERRITORY, OCCUPIED (PS) 
PANAMA (PA) 
PAPUA NEW GUINEA (PG) 
PARAGUAY (PY) 
PERU (PE) 
PHILIPPINES (PH) 
POLAND (PL) 
PORTUGAL (PT) 
PUERTO RICO (PR) 
QATAR (QA) 
REUNION (RE) 
ROMANIA (RO) 
RUSSIAN FEDERATION (RU) 
RWANDA (RW) 
SAINT KITTS AND NEVIS (KN) 
SAINT LUCIA (LC) 
SAINT PIERRE AND MIQUELON (PM) 
SAINT VINCENT AND THE GRENADINES (VC) 
SAMOA (WS) 
SAN MARINO (SM) 
SAO TOME AND PRINCIPE (ST) 
SAUDI ARABIA (SA) 
SENEGAL (SN) 
SERBIA (RS) 
SEYCHELLES (SC) 
SIERRA LEONE (SL) 
SINGAPORE (SG) 
SLOVAKIA (SK) 
SLOVENIA (SI) 
SOLOMON ISLANDS (SB) 
SOMALIA (SO) 
SOUTH AFRICA (ZA) 
SPAIN (ES) 
SRI LANKA (LK) 
SUDAN (SD) 
SURINAME (SR) 
SWAZILAND (SZ) 
SWEDEN (SE) 
SWITZERLAND (CH) 
SYRIAN ARAB REPUBLIC (SY) 
TAIWAN (TW) 
TAJIKISTAN (TJ) 
TANZANIA, UNITED REPUBLIC OF (TZ) 
THAILAND (TH) 
TIMOR-LESTE (TL) 
TOGO (TG) 
TOKELAU (TK) 
TONGA (TO) 
TRINIDAD AND TOBAGO (TT) 
TUNISIA (TN) 
TURKEY (TR) 
TURKMENISTAN (TM) 
TURKS AND CAICOS ISLANDS (TC) 
TUVALU (TV) 
UGANDA (UG) 
UKRAINE (UA) 
UNITED ARAB EMIRATES (AE) 
UNITED KINGDOM (GB) 
UNITED STATES (US) 
UNITED STATES MINOR OUTLYING ISLANDS (UM) 
URUGUAY (UY) 
UZBEKISTAN (UZ) 
VANUATU (VU) 
VENEZUELA (VE) 
VIET NAM (VN) 
VIRGIN ISLANDS, BRITISH (VG) 
VIRGIN ISLANDS, U.S. (VI) 
WALLIS AND FUTUNA (WF) 
YEMEN (YE) 
ZAMBIA (ZM) 
ZIMBABWE (ZW) 
Choose any of the countries by typing in the two letter code between the ( ).

You can then check at anytime the hits that might be happening to your system.

$ sudo iptables -nvL INPUT
Chain INPUT (policy ACCEPT 9523 packets, 3125K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
    0     0 f2b-proftpd  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 21,20,990,989
 2847  170K f2b-sshd   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22
   12   548 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set CHINA src multiport dports 22,10000
    4   176 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set RUSSIANFEDERATION src multiport dports 22,10000
    1    44 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set NETHERLANDS src multiport dports 22,10000
    2    88 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set GERMANY src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set DENMARK src multiport dports 22,10000
  157  8156 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set FRANCE src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set INDONESIA src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set IRELAND src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set ITALY src multiport dports 22,10000
    4   180 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set KOREAREPUBLICOF src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set SINGAPORE src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set TAIWAN src multiport dports 22,10000
  947 48804 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set VIETNAM src multiport dports 22,10000
    2    92 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set BRAZIL src multiport dports 22,10000
    6   264 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set UKRAINE src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set PORTUGAL src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set ISRAEL src multiport dports 22,10000
    3   180 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set UNITEDKINGDOM src multiport dports 22,10000
    1    44 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set JAPAN src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set PAKISTAN src multiport dports 22,10000
    2    88 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set ARGENTINA src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set COLOMBIA src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set FINLAND src multiport dports 22,10000
    4   188 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set INDIA src multiport dports 22,10000
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set CUSTOM_IP src multiport dports 22,10000

Hope this helps!

7

All those attempted logins are for the root user so it looks like just basic brute-force attempts via SSH.

It's entirely normal for a public-facing server to have lots of SSH brute-force attempts a day. It's a fact of life. You can start reporting them to the ISP who owns the IP address, but it's whack-a-mole and you're not going to make a big difference. They're using compromised computers all over the internet and/or hosting accounts they signed up for under false details.

What would make a difference is if everyone decided to disable root login over SSH, and/or require key-based login for root (or for everyone). As long as you've done one of these the brute-force attempts will basically be ineffective. But because enough people still leave plain root login enabled, and have a guessable password on it, these attacks continue.

Another thing that some people recommend is switching your SSH daemon to a non-standard port number, although I prefer not to do this because the security benefit it brings is not huge and I like using standard port 22.

As for your second question, this is just Cron running, which is the program tha runs scheduled tasks. All systems have a bunch of scheduled tasks configured by default by the system. Since cron can run different tasks as different users it uses pam_unix to handle starting a user session, even when root, so that's why it appears in that log.

3

Unless you have Nation State level control/access over all computers/networks available to your server finding the person behind the login attempts is functionally impossible. You can however work to harden your server. see, How to harden an SSH server?, and What Can Be Done To Secure Ubuntu Server?

2

The IP address 218.87.109.156 is not in DNS, and tracepath (from Ottawa, Canada) shows:

  w3@aardvark:~(0)$ tracepath  218.87.109.156
 1?: [LOCALHOST]                                         pmtu 1492
 1:  spark2y                                               0.739ms 
 1:  spark2y                                               0.744ms 
 2:  dsl-173-206-128-1.tor.primus.ca                      31.017ms 
 3:  10.201.117.46                                        31.425ms asymm  5 
 4:  38.88.240.86                                         30.987ms 
 5:  be4181.ccr31.yyz02.atlas.cogentco.com                30.872ms 
 6:  be2993.ccr21.cle04.atlas.cogentco.com                38.281ms 
 7:  be2717.ccr41.ord01.atlas.cogentco.com                45.373ms 
 8:  sjo-b21-link.telia.net                               92.369ms 
 9:  be3035.ccr21.den01.atlas.cogentco.com                68.380ms 
10:  202.97.50.77                                         96.352ms asymm 15 
11:  be3109.ccr21.sfo01.atlas.cogentco.com                96.099ms 
12:  be3179.ccr22.sjc01.atlas.cogentco.com                95.375ms 
13:  202.97.57.26                                        233.831ms asymm 14 
14:  202.97.82.126                                       278.546ms asymm 20 
15:  117.44.130.118                                      250.081ms asymm 21 
16:  111.74.206.105                                      249.725ms asymm 21 
17:  117.44.130.146                                      245.893ms asymm 18 
18:  202.97.57.26                                        232.033ms asymm 14 
19:  202.97.39.58                                        241.135ms asymm 16 
20:  111.74.207.46                                       268.148ms asymm 17 
21:  218.87.109.156                                      246.090ms reached

Doing dig -x and tracepath on the rest of the IPs is left as an exercise.

I'd guess that you're under attack. If you're not behind a firewall (and why not?), investigate the fail2ban package, or, if you're not using it, stop running sshd.

CRON is the system's job scheduler, on my system, I see hundreds of these a day.

  • 1
    I think you can't specifically identify this as an attack unless you have conclusive evidence that there are a lot of attacks from just this specific IP address. Consider that these're likely service scanners attempting to find exploit points in order to infect and control your server, but aren't necessarily directed just at your system (for the failed SSH login part) – Thomas Ward Dec 5 '17 at 23:27
1

You can also change the default port to another non-standard port if you don't necessary need port 22 on the internet.

Even if you use fail2ban you will still have a number of failed attempts / day. I never leave the default port open to the internet. For SSH at least. Lots of bots these days bruteforcing.

You can do this by editing the file /etc/ssh/sshd_config There must be a line similar to:

#Port 22 Remove the # in front and change 22 to your desired port value ( 1 to 65535 )

Example: Port 1337

Then you can test the validity of the config ( make sure there's no extra characters, or it might not start - this is useful when you're restarting sshd remote, it might not restart properly and you need access via other routes ) Test using the command : /usr/sbin/sshd -t

Remember: no output generally means no error.

And then you need to restart sshd service:

sudo systemctl restart sshd

or

sudo service sshd restart

or

sudo killall -HUP sshd

Then you can ssh into your server using the custom port. From other terminal you can use:

ssh <serverHostname> -p <port>.

And for lazy people like me, if you don't want to specify that port all the time, you can change the default port in the same manner in file /etc/ssh/ssh_config ( this is the file for the ssh command ) so you don't have to add the -p <port> option all the time.

  • 1
    can you edit your answer to explain how I should do it? – yukashima huksay Dec 6 '17 at 17:43
  • Sure. Tell me if it's clear enough :) – dubsauce Dec 7 '17 at 13:05
  • I did this and now in netstat -atn I see that tcp 0.0.0.0:1382 is being listened to but If I want to ssh I get timed out. – yukashima huksay Dec 7 '17 at 17:16
  • Is the machine directly connected to the internet? You might need to create port forwarding rules in the router if not. Or maybe iptables is set up and it blocks it ? Can you run an iptables -L -n ? – dubsauce Dec 8 '17 at 17:35
  • the problem was with ufw. I fixed it thanks:) – yukashima huksay Dec 9 '17 at 13:16

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.