identifying suspicious ssh activity

piramiday · 02-10-2014, 08:52 AM

hey guys,

I've recently found a weird IP address amongst my ntop statistics.
I've managed to get a look at the connection through nethog:

Code:

NetHogs version 0.8.0

  PID USER     PROGRAM                                                   DEV        SENT      RECEIVED
10986 user     sshd: user@pts/0                                          eth1    1293.875     165.113 KB
?     root     192.168.0.10:22-118.123.213.47:42920                                 0.000       0.145 KB
?     root     unknown TCP                                                          0.000       0.000 KB

  TOTAL                                                                          1293.875     165.258 KB

but nethog does not report any PID.
[note: the PID 10986 is mine, I've left it there instead of grepping it away.]
the specified IP address is that of a SSH attacker that has been banned through iptables.
I don't understand whether this is some kind of connection generated by fail2ban or the iptables rdns, or something else.

should I be alerted?
any help's appreciated. thanks!

unSpawn · 02-11-2014, 02:42 AM

RCV 0.145 KB: prolly means their initial request, SND: 0.000 KB: prolly means no reply sent back: grep your SSH log for "-i refused" and you should find the IP address.

piramiday · 02-11-2014, 04:33 PM

I certainly hope so, but please note that the attacker IP has been banned through iptables. there is no entry in /var/log/auth.log... what do you mean with "ssh log"? thanks!

unSpawn · 02-11-2014, 05:27 PM

Quote:

Originally Posted by piramiday

please note that the attacker IP has been banned through iptables.

You say it is but you don't show it is (as in

Code:

JAILLIST=($(fail2ban-client status | awk -F':' '/Jail list:/ {print $2}')); for (( n=0; n<${#JAILLIST[@]}; n++)); do fail2ban-client status ${JAILLIST[$n]//,/}; done

or

Code:

grep 'fail2ban.actions:' /var/log/messages

or

Code:

iptables -t filter -nvxL INPUT | grep 118.123.213.47

I mean).

Quote:

Originally Posted by piramiday

there is no entry in /var/log/auth.log... what do you mean with "ssh log"?

Something like /var/log/secure or whatever equivalent that (r)syslog(-ng) logs "authpriv.*" messages to.

piramiday · 02-11-2014, 06:02 PM

well, I say it's banned because it shows up in my iptables -L list.

I have no /var/log/secure, and there is no authpriv logfile...

thanks!