question about hack attempt

danff · 11-07-2007, 03:02 AM

I am fairly new with linux and am running linux on a dv server.

I opened up my messages log file for the first time and found hundreds of lines similar to this:

Nov 4 22:22:05 xxxxx sshd(pam_unix)[24000]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-219-188-112.hinet-ip.hinet.net user=root
Nov 4 22:22:09 xxxxxx sshd(pam_unix)[24162]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-219-188-112.hinet-ip.hinet.net user=root

and

Nov 4 10:57:28 xxxxxx sshd(pam_unix)[30026]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mayomo.icnhost.net user=root

Nov 4 10:52:49 xxxxxxx sshd(pam_unix)[13864]: check pass; user unknown
Nov 4 10:52:49 xxxxxxx sshd(pam_unix)[13864]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mayomo.icnhost.net

Im assuming these are attempts at gaining root access and using mail services? how can I stop these attempts and block the ip's/domains and check to see if they've been successful? Im now worried that my lack of attention to logs means iv left myself open to getting screwed.

acid_kewpie · 11-07-2007, 03:17 AM

well to stop them, check out a tool like fail2ban, which reads these logs and automatically inserts rules to stop the source ip connecting. if you additionally configure ssh to deny root logins, check /etc/sshd_config, then you should be able to be very comfortable that they won't be able to guess a potentially valid user account to attack on before fail2ban has blocked their access. if you already have potential concerns then a root kit tool like rkhunter is worth running to check you're ok.

danff · 11-07-2007, 03:25 AM

Quote:

Originally Posted by acid_kewpie

well to stop them, check out a tool like fail2ban, which reads these logs and automatically inserts rules to stop the source ip connecting. if you additionally configure ssh to deny root logins, check /etc/sshd_config, then you should be able to be very comfortable that they won't be able to guess a potentially valid user account to attack on before fail2ban has blocked their access. if you already have potential concerns then a root kit tool like rkhunter is worth running to check you're ok.

thx. just started doing some research. seems these attempts are common. possibly going to lock all ips out from ssh except my own and look into fail2ban

acid_kewpie · 11-07-2007, 03:28 AM

oh they are extremely common. someone has a bot just scanning for port 22 across the net, somethign answers and a dictionary attack follows... very rare to actually get compromised, but prcuations are obviosuly good...