system error in ubuntu 18.04

Tomdf · 03-29-2019, 02:39 PM

Hi Guys,

i am running a webserver with ubuntu 18.04.

systemctl -xe gives me a lot of errors and i try to figure out what is going on.
i think i get spam and postfix shows every minute errors as well as many authentication failures.
It seems someone try to connect with ssh from unknown servers.

Code:

Mar 29 20:25:50 server1. sshd[1800]: Failed password for root from 218.92.0.131 port 45895 ssh2
Mar 29 20:25:52 server1. sshd[1805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.8
Mar 29 20:25:53 server1. sshd[1800]: Failed password for root from 218.92.0.131 port 45895 ssh2
Mar 29 20:25:53 server1. sshd[1805]: Failed password for root from 112.85.42.232 port 33488 ssh2
Mar 29 20:33:51 server1. sshd[2292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.9
Mar 29 20:33:53 server1. sshd[2295]: Invalid user eh from 122.3.139.131 port 58928
Mar 29 20:33:53 server1. sshd[2295]: pam_unix(sshd:auth): check pass; user unknown
Mar 29 20:33:53 server1. sshd[2295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.3
lines 2037-2059/2059 (END)

maybe someone can help me to resolve this problems that would be great.

thanks a lot for your kind help
Tom

berndbausch · 03-29-2019, 05:53 PM

Somebody or something tries to log on from three different IP addresses as root or as user “eh”, and fails. I guess this is normal if your server is exposed to the internet and has no firewall that protects it against such attempts. It happened to me at home when I configured my router to forward port 22 to one of my computers.

I can’t say anything about your postfix errors. You may want to share details.

frankbell · 03-29-2019, 08:37 PM

Random port scans have been a fact of life on the internet since the internet.

If you have not installed fail2ban, you may wish to take a look at it.