Hi Folks,

I am new to linux and I was poking around in /var/log/* I found a lot of "stuff" in the secure file as well as messages

Here is some of the stuff in /var/log/secure

Feb 10 21:49:53 localhost sshd[7857]: Failed password for invalid user admins from 218.146.254.87 port 51145 ssh2
Feb 10 21:49:57 localhost sshd[7859]: Failed password for bin from 218.146.254.87 port 51205 ssh2
Feb 10 21:50:02 localhost sshd[7862]: Failed password for daemon from 218.146.254.87 port 51649 ssh2
Feb 10 21:50:06 localhost sshd[7864]: Failed password for lp from 218.146.254.87 port 52100 ssh2
Feb 10 21:50:11 localhost sshd[7866]: Failed password for sync from 218.146.254.87 port 52565 ssh2
Feb 10 21:50:15 localhost sshd[7869]: Failed password for shutdown from 218.146.254.87 port 53002 ssh2
Feb 10 21:50:19 localhost sshd[7871]: Failed password for halt from 218.146.254.87 port 53460 ssh2
Feb 10 21:50:24 localhost sshd[7873]: Failed password for uucp from 218.146.254.87 port 53928 ssh2
Feb 10 21:50:28 localhost sshd[7875]: Failed password for smmsp from 218.146.254.87 port 54389 ssh2


And here is some from /var/log/messages

eb 11 22:35:11 localhost sshd(pam_unix)[16645]: check pass; user unknown
Feb 11 22:35:11 localhost sshd(pam_unix)[16645]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spcomputing.demon.co.uk
Feb 11 22:35:15 localhost sshd(pam_unix)[16648]: check pass; user unknown
Feb 11 22:35:15 localhost sshd(pam_unix)[16648]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spcomputing.demon.co.uk
Feb 11 22:35:20 localhost sshd(pam_unix)[16650]: check pass; user unknown
Feb 11 22:35:20 localhost sshd(pam_unix)[16650]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spcomputing.demon.co.uk
Feb 11 22:35:26 localhost sshd(pam_unix)[16652]: check pass; user unknown
Feb 11 22:35:26 localhost sshd(pam_unix)[16652]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spcomputing.demon.co.uk
Feb 11 22:35:36 localhost sshd(pam_unix)[16655]: check pass; user unknown
Feb 11 22:35:36 localhost sshd(pam_unix)[16655]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spcomputing.demon.co.uk
Feb 11 22:35:42 localhost sshd(pam_unix)[16657]: check pass; user unknown
Feb 11 22:35:42 localhost sshd(pam_unix)[16657]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spcomputing.demon.co.uk
Feb 11 22:35:50 localhost sshd(pam_unix)[16660]: check pass; user unknown
Feb 11 22:35:50 localhost sshd(pam_unix)[16660]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spcomputing.demon.co.uk
Feb 11 22:35:58 localhost sshd(pam_unix)[16662]: check pass; user unknown
Feb 11 22:35:58 localhost sshd(pam_unix)[16662]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spcomputing.demon.co.uk
Feb 11 22:36:10 localhost sshd(pam_unix)[16679]: check pass; user unknown
Feb 11 22:36:10 localhost sshd(pam_unix)[16679]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spcomputing.demon.co.uk


Is this something to be concerned with??
I do have a port open which has been closed. Is having a port open on my router for ssh bad??

Thank you for your time!

ha ha welcome to Failed SSH logins.

http://www.linuxquestions.org/questi...d.php?t=340366

I suppose this is normal?

Should I be concerned about it?

Thanks!

If you have strong passwords (better, use keys instead of passwords for your remote connections), no root login allowed (use su), and protocol 2 only then you have a strong base set up. Googling on securing ssh returns a bunch of sites for further tweaks.

Yep, it is normal and it's no great concern. You should make sure all non-user accounts have a * in their password field and an invalid shell -- but this is the default situation on every system I have seen.

Also, disable root login for ssh (probably already done as a default) and make sure all your users have good passwords. And/or you can limit the users who can login through ssh as well -- if you have several users who should never connect remotely.

But... for the most part... you have little to worry about. These automated scripts are very common but not very effective against machines which weren't massively misconfigured.