LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 04-19-2007, 08:39 AM   #1
sorenp
LQ Newbie
 
Registered: Dec 2006
Posts: 11

Rep: Reputation: 0
Strange sshd log messages


Hi everybody,

I get a log message from sshd every five minutes looking like this

<pre>
Apr 19 13:55:29 server1 sshd[5701]: Did not receive identification string from x.x.x.x
Apr 19 14:00:29 server1 sshd[5730]: Did not receive identification string from x.x.x.x
</pre>

What is really strange is that x.x.x.x is one of the machines own IP address. Moreover, the interface that handles x.x.x.x is configured to block all non-imcp traffic (with iptables). (Note: due to another external firewall, x.x.x.x is not accessible from the internet)

I've been trying to find any local process that could be responsible for making these connections, but I can't find anything suspicious.

Anyone got an idea what might be going on?

Thankful for any help,

Soren
 
Old 04-19-2007, 11:47 AM   #2
jrmann1999
Member
 
Registered: Feb 2001
Location: Texas
Distribution: Slackware, Mandrake, LFS
Posts: 306

Rep: Reputation: 30
assuming you have ethereal or wireshark(console versions of both)

Code:
tethereal/tshark -i any -f 'host x.x.x.x and host y.y.y.y'
y.y.y.y should be the IP of your good interface, x.x.x.x above relates to your bad interface.
Watch that for a few minutes to see if the machine is making requests to the server, if so you might be able to go more verbose and see what exactly it's passing. Maybe it's a rouge heartbeat app of some kind(do you run any network process monitor app).

Blocking all except icmp on x.x.x.x isn't going to work as this is outbound trafic, your log is telling you that x.x.x.x is trying to connect to your other IP, and the reply from your other IP is getting dropped on the way back thanks to your iptables script.

You could also try
Code:
iptables -A OUTPUT -o <interface> -s x.x.x.x -d y.y.y.y -p tcp --dport 22 -j LOG 
iptables -A OUTPUT -o <interface> -s x.x.x.x -d y.y.y.y -p tcp --dport 22 -j DROP
If something breaks, you've just found your culprit(and have kernel logs to see a little more info).
 
Old 04-19-2007, 01:52 PM   #3
sorenp
LQ Newbie
 
Registered: Dec 2006
Posts: 11

Original Poster
Rep: Reputation: 0
Thanks for your elaborate response.

While reading your comment about network process monitors I suddenly realized that I compiled the newest version of my intrusion detection system with the "open ports" scan option enabled. After turning off the scan, the messages disappeared. God, am I stupid?

I'm still a little puzzled that the IDS managed to make connections from x.x.x.x to the ssh server. I forgot to mention it in my last post, but x.x.x.x and y.y.y.y are on two separate networks and there is no route from x.x.x.x to y.y.y.y (or the other way around). This was why I thought that the firewall on x.x.x.x should take care such problems. Being curious of nature I'll take a deeper look on this using wireshark (the software is new to me but looks very interesting) as soon as I get the time.

Thanks once more,

Soren
 
Old 04-19-2007, 01:58 PM   #4
sorenp
LQ Newbie
 
Registered: Dec 2006
Posts: 11

Original Poster
Rep: Reputation: 0
Just to answer my own question: I found that the traffic to x.x.x.x:22 was sent from x.x.x.x. The traffic was, however, sent over the loopback interface which was why it wasn't stopped by the firewall.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Strange "martian source" messages in my linux gateway log files Dr3am3r Linux - Networking 2 12-09-2006 09:57 AM
Very Urgent! Strange msg in /var/log/messages sathyguy Linux - Newbie 3 07-27-2006 05:07 AM
strange system log messages ? deft Linux - Security 23 11-13-2004 10:47 AM
strange logs in /var/log/messages dominant Linux - Security 1 04-21-2004 01:12 PM
Messages log, strange Equis Linux - Security 1 03-28-2004 05:48 AM


All times are GMT -5. The time now is 05:35 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration