How to prevent polkit and authentication failure further

newbie14 · 05-07-2019, 11:18 AM

I have brand new server setup. I have permanently close the root login and password. Everything is key based but yet I get below.
I dont understand about the polkit-1 and how can I further harden the system ?

Code:

polkit-1:
    Unknown Entries:
       authentication failure; logname= uid=1000 euid=0 tty= ruser=root rhost=  user=root: 2 Time(s)
       auth could not identify password for [root]: 1 Time(s)
       conversation failed: 1 Time(s)

 sshd:
    Authentication Failures:
       root (58.242.82.9): 39783 Time(s)
       root (218.92.0.154): 13128 Time(s)
       root (58.242.83.39): 9486 Time(s)
       root (103.243.183.230): 8044 Time(s)
       root (58.242.83.37): 3127 Time(s)
       root (58.242.83.18): 1794 Time(s)

hazel · 05-07-2019, 11:48 AM

Polkit is asking for an authorisation password. What that means in practice depends on your polkit rules. You'll find these under /etc/polkit or possibly /etc/polkit-1 (I'm not sure of the exact name on your system).

Usually the root password is included by default. Other passwords may also be recognised, for example those of people in the sudo group or the wheel group. There may be individual users whose passwords are authoritative. It's up to the system administrator to tailor these rules to local requirements.

If you have removed the root login password then you will have to edit the polkit rules to accept some other password for authorisation, such as one of the possibilities I have suggested.

scasey · 05-07-2019, 12:27 PM

Quote:

Originally Posted by newbie14

I have brand new server setup. I have permanently close the root login and password. Everything is key based but yet I get below.
I dont understand about the polkit-1 and how can I further harden the system ?

Code:

polkit-1:
    Unknown Entries:
       authentication failure; logname= uid=1000 euid=0 tty= ruser=root rhost=  user=root: 2 Time(s)
       auth could not identify password for [root]: 1 Time(s)
       conversation failed: 1 Time(s)

 sshd:
    Authentication Failures:
       root (58.242.82.9): 39783 Time(s)
       root (218.92.0.154): 13128 Time(s)
       root (58.242.83.39): 9486 Time(s)
       root (103.243.183.230): 8044 Time(s)
       root (58.242.83.37): 3127 Time(s)
       root (58.242.83.18): 1794 Time(s)

Those appear to be reports of many attempts to ssh to your server as the root user.
(All of those IP addresses are in China -- sigh)
If you've disabled root login via ssh, you are blocking them successfully.

newbie14 · 05-07-2019, 11:55 PM

Quote:

Originally Posted by hazel

Polkit is asking for an authorisation password. What that means in practice depends on your polkit rules. You'll find these under /etc/polkit or possibly /etc/polkit-1 (I'm not sure of the exact name on your system).

Usually the root password is included by default. Other passwords may also be recognised, for example those of people in the sudo group or the wheel group. There may be individual users whose passwords are authoritative. It's up to the system administrator to tailor these rules to local requirements.

If you have removed the root login password then you will have to edit the polkit rules to accept some other password for authorisation, such as one of the possibilities I have suggested.

Hi Hazel,
I found this etc/polkit-1 and in it I got localauthority localauthority.conf.d rules.d so which files should I touch? I notice localauthority.conf.d is empty. So next time I setup a new system I should set polkit-1 cause I never touch in Centos 6 before on this? So site even suggest it can be remove I am not sure to do that or not ?

newbie14 · 05-08-2019, 12:03 AM

Quote:

Originally Posted by scasey

Those appear to be reports of many attempts to ssh to your server as the root user.
(All of those IP addresses are in China -- sigh)
If you've disabled root login via ssh, you are blocking them successfully.

Hi scacey,
Actually beside that there are many other username attempt too e.g as below. I know we cant completely avoid this what else can I harden. I have also attached my sshd settings maybe you could suggest anything further.

Code:

 unknown (138.186.113.11): 105 Time(s)
       unknown (broadband-46-242-50-223.ip.moscow.rt.ru): 103 Time(s)
       unknown (161.117.2.115): 98 Time(s)
       unknown (111.53.76.186): 95 Time(s)
       root (111.53.76.186): 77 Time(s)
       root (103.99.2.170): 72 Time(s)
       root (193.36.119.45): 59 Time(s)
       root (103.45.111.93): 57 Time(s)
       root (115.231.220.43): 48 Time(s)
       unknown (ec2-54-236-19-126.compute-1.amazonaws.com): 33 Time(s)
       unknown (192.81.219.158): 30 Time(s)
       ftp (103.99.2.170): 24 Time(s)
       unknown (134.209.149.14): 20 Time(s)
       unknown (142.93.94.223): 17 Time(s)
       root (138.186.113.11): 14 Time(s)
       root (broadband-46-242-50-223.ip.moscow.rt.ru): 14 Time(s)
       root (89.197.161.164): 12 Time(s)
       unknown (68.183.39.206): 11 Time(s)
        root (151.53.243.41): 5 Time(s)
       unknown (134.209.5.132): 5 Time(s)
       unknown (139.59.36.226): 5 Time(s)
       unknown (157.230.61.228): 5 Time(s)
       unknown (165.22.149.123): 5 Time(s)
       unknown (185.232.67.11): 5 Time(s)
       unknown (206.189.29.59): 5 Time(s)
       unknown (238.ip-144-217-80.net): 5 Time(s)
       root (134.209.149.14): 4 Time(s)
       root (185.244.25.126): 4 Time(s)
       root (213.195.110.192): 4 Time(s)
       unknown (68.183.210.191): 4 Time(s)
       root (111.7.164.67): 3 Time(s)
       unknown (213.195.110.181): 3 Time(s)
       bin (111.53.76.186): 2 Time(s)
       root (142.93.94.223): 2 Time(s)
       root (68.183.210.191): 2 Time(s)
       unknown (1.232.77.181): 2 Time(s)
       unknown (141.98.81.37): 2 Time(s)
       unknown (91.106.187.91): 2 Time(s)
       unknown (91.106.187.91): 2 Time(s)
       bin (132.145.34.87): 1 Time(s)
       games (132.145.34.87): 1 Time(s)
       mail (161.117.2.115): 1 Time(s)
       root (132.145.34.87): 1 Time(s)
       unknown (41.39.241.37): 1 Time(s)
       unknown (41.46.78.32): 1 Time(s)
       unknown (ec2-18-205-125-11.compute-1.amazonaws.com): 1 Time(s)
       unknown (lh41.dnsireland.com): 1 Time(s)
       unknown (mx-ll-14.207.194-17.dynamic.3bb.co.th): 1 Time(s)
 Invalid Users:
       Unknown Account: 890 Time(s)
    Unknown Entries:
       service(sshd) ignoring max retries; 6 > 3: 9044 Time(s)
       service(sshd) ignoring max retries; 5 > 3: 9 Time(s)
       service(sshd) ignoring max retries; 4 > 3: 4 Time(s)

One more method I am going to do is change the port 22 but the rest I am not too sure what could help to further harden the system.

Code:

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
MaxAuthTries 2
#MaxSessions 10

#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2

# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile      .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes

# GSSAPI options
GSSAPIAuthentication no
GSSAPICleanupCredentials no
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
# problems.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation sandbox
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
Banner none

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

# override default of no subsystems
Subsystem       sftp    /usr/libexec/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server

tshikose · 05-21-2019, 05:59 AM

Hi,

Install and activate fail2ban.

newbie14 · 05-22-2019, 03:52 AM

Hi Tshikose,
How about this polkit thing how to resolve on this authentication error and etc. Yes I already started on the fail2ban hardening too.

tshikose · 05-22-2019, 05:23 AM

Hi,

I am sorry, I am not familiar with polkit.
But for the hacking attempts from China, fail2ban is what you need.

newbie14 · 05-22-2019, 10:26 AM

Hi Tshikose,
Yes I have enabled it but I still get some funny connection like preauth etc. How to further harden to minimise all these hacking attempts.

tshikose · 05-22-2019, 10:41 AM

Hi,

I am sorry, I have never heard of preauth.

If you can access your server from an internal connection (or VPN), you better add that network in the white list to never lock yourself our for.
I usually ban failures on SSH for a full day (24 hours), so it will be desastrous for me to have to wait 24 hours to fix a problem.

newbie14 · 05-22-2019, 11:39 PM

Hi Tshikose,
For example I extract some of it here. So how to further harden to avoid all these.

Quote:

Couldn't resolve these IPs:
179-92-111-129.user.vivozap.com.br [179.92.111.129]: 36 Time(s)
29.32.81.117.broad.sz.js.dynamic.163data.com.cn [117.81.32.29]: 1 Time(s)

Didn't receive an ident from these IPs:
103.99.2.170 port 49301: 1 Time(s)

Disconnecting after too many authentication failures for user:
<unknown> : 7 Time(s)

Illegal users from:
undef: 31 times
[preauth]: 1 time
Management [preauth]: 1 time
a [preauth]: 1 time
a2 [preauth]: 1 time
admin [preauth]: 1 time
fake [preauth]: 1 time

Received disconnect:
11: [preauth]
180.101.45.31 : 2 Time(s)
222.187.221.173 : 2 Time(s)
222.187.221.202 : 2 Time(s)

tshikose · 05-23-2019, 02:13 AM

Hi,

From which log file to you read those lines?

The Couldn't resolve these IPs: to me seems to be reverse DNS failures. They should not really be a problem. They just eat up your bandwidth. Some shut down that feature.

For the others, I will really want to know from you get them.
/var/log/messages
/var/log/secure
journalctl -u sshd
Just few I thought of.

newbie14 · 05-23-2019, 06:01 AM

Hi,
I actually got this from daily logwatch which is email to me. Can I sptop the reverse dns failure totally ? What else can I shut down to minimise my bandwidth usage and improve security more.

tshikose · 05-23-2019, 09:36 AM

Hi,

I do think you can do several things.
But for me to be able to guide more effectively, I need some information that you have not provided yet.
To stop the DNS querying I need to know which service is doing that.
I am not really familiar with logwatch email, but I think it give section headers that identify to what the report part is related. So what is the section of those DNS queries?

newbie14 · 05-23-2019, 10:41 AM

Hi,
I am not sure exactly what you asking me. But I guess this the heading you looking ? Its from sshd

Quote:

--------------------- SSHD Begin ------------------------

Couldn't resolve these IPs:
179-92-111-129.user.vivozap.com.br [179.92.111.129]: 36 Time(s)
29.32.81.117.broad.sz.js.dynamic.163data.com.cn [117.81.32.29]: 1 Time(s)
broadband-37.204-127-164.ip.moscow.rt.ru [37.204.127.164]: 2 Time(s)
dedi08.customers.kvsolutions.nl [185.244.25.105]: 2 Time(s)
host-156.209.21.18-static.tedata.net [156.209.18.21]: 1 Time(s)
promote.cache-dns.local [223.111.139.203]: 4 Time(s)
promote.cache-dns.local [223.111.139.239]: 4 Time(s)
static.vnpt.vn(113.173.108.226): 1 Time(s)