URGENT: hacker's attack on linux box

yawe_frek · 08-04-2007, 09:01 AM

hi friends,

for some time now i have beeing seeing such messages in my /var/log/secure
Jun 7 01:08:59 host sshd[1955]: Did not receive identification string from 72.20.1.250
Jun 7 01:09:59 host sshd[3959]: Did not receive identification string from 72.20.1.250
Jun 7 01:10:56 host sshd[5937]: Did not receive identification string from 69.61.56.114
Jun 7 01:11:56 host sshd[7752]: Did not receive identification string from 69.61.56.114
Jun 7 01:12:55 host sshd[9633]: Did not receive identification string from 69.61.56.114
Jun 7 01:13:56 host sshd[11530]: Did not receive identification string from 69.61.56.114

i am suspecting an hacker's attemping to gain access.

how can i change my ssh port to a differ one and how do i know which port is available.

Thnaks

AlucardZero · 08-04-2007, 10:12 AM

Code:

man sshd_config

Code:

      Port    Specifies the port number that sshd listens on.  The default is 22.  Multiple
             options of this type are permitted.  See also ListenAddress.

Also look into programs that block IPs after X number of unsuccessful logins, such as fail2ban and DenyHosts

Hangdog42 · 08-04-2007, 02:07 PM

Also look at the sticky on failed SSH attempts at the top of this forum.

mistersnorfles · 08-08-2007, 03:19 AM

You could also look into setting up port knocking...

http://www.linuxjournal.com/article/6811

Hope this helps...

---Mr. Snorfles

orion.echo · 08-08-2007, 07:42 AM

yawe_frek

You could block these IP addresses using iptables

just a thought.