SSHD brute force attacks ?
 

I seem to be seeing a lot of atempts at brute forcing SSHD on my servers:

May 26 09:01:47 hooker sshd[68152]: Failed password for illegal user httpd from 65.205.238.12 port 43865 ssh2
May 26 09:01:47 hooker sshd[68154]: Illegal user arun from 65.205.238.12
May 26 09:01:47 hooker sshd[68154]: Failed password for illegal user arun from 65.205.238.12 port 43911 ssh2
May 26 09:01:47 hooker sshd[68136]: Illegal user chris from 80.122.129.122
May 26 09:01:48 hooker sshd[68136]: Failed password for illegal user chris from 80.122.129.122 port 24320 ssh2
May 26 09:01:48 hooker sshd[68155]: Illegal user bill from 65.205.238.12
May 26 09:01:48 hooker sshd[68155]: Failed password for illegal user bill from 65.205.238.12 port 43936 ssh2
May 26 09:01:48 hooker sshd[68159]: Illegal user dave from 65.205.238.12

anyone else seeing this or am is someone on my case?

nothing unusual

people are always trying to brute force something

hah i get them all the time on my server, same with ftp. make sure you have most current up to date ssh, or you are asking for trouble

hah i get them all the time on my server, same with ftp. make sure you have most current up to date ssh, or you are asking for trouble

You can use a program like portsentry, wich can be configured to automatically lock out brute force attackers, portscans etc.

yesterday was quiet on one of my boxes:

sshd:
Invalid Users:
Unknown Account: 13762 Time(s)

I always change the default ssh port, and lock down the server with a firewall. If you have X, try "firestarter" for linux.

It's very common, but it's super simple to stop.

add this to your iptables firewall

It will block the sshd port if an ip attempts more than 3 times per minute
to login with a bad password.

-N ssh_brute
-A ssh_brute -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
-A ssh_brute -p TCP --syn -m limit --limit 3/minute --limit-burst 3 -j ACCEPT
-A ssh_brute -p TCP -j LOG --log-level "WARN" --log-prefix [DROP:RATE_LIMIT]
-A ssh_brute -p TCP -j REJECT
-I INPUT -p TCP -s 0/0 --dport 22 -j ssh_brute

:thumbsup

There's a commonly run SSH brute force program available, it's retardedly simple, it just has a mass of usernames / passwords and it tries them all in succession. Best way to avoid any problems is to use decent passwords. SSH as a protocol is pretty damn solid, so long as you're not still using v1 (which is quite unlikely).

of course the best way is to restrict sshd, ftpd and such to ip addresses.
but this requires a static ip address. If you want to access your machine from
different locations (traveling) use 1 server/computer with VPN as trusted host.

:2 cents:

I've had 1,200 brute force attacks on sshd on my server in the past week from the same IP. Korean based.

you can just mask a whole hostname, i just allow it from my dsl provider which is a fairly unused provider where i am.