LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 08-17-2012, 04:03 AM   #1
Babelduo
LQ Newbie
 
Registered: Mar 2009
Posts: 12

Rep: Reputation: 0
Possible attack on the ssh server? Bad protocol version identification


Hi,

I'm using debian squeeze as a root web server. I'm checking my logs with the help of ossec. This morning I got a "possible attack warning" because of the following log (auth.log):

Code:
Aug 17 10:20:01 myserver CRON[5550]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 17 10:20:02 myserver CRON[5550]: pam_unix(cron:session): session closed for user root
Aug 17 10:21:28 myserver sshd[5567]: Bad protocol version identification 'GET /robots.txt HTTP/1.1' from 127.0.0.1
Aug 17 10:21:29 myserver sshd[5569]: Bad protocol version identification 'GET /robots.txt HTTP/1.1' from 127.0.0.1
Its just weired for me that it comes from 127.0.0.1... I wasnt logged in into the server. How can I find out more about what happend at this time or which cron did this?

Kim

p.s: sry I wanted to put this into Security!

Last edited by Babelduo; 08-17-2012 at 04:04 AM.
 
Old 08-17-2012, 07:27 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by Babelduo View Post
I wasnt logged in into the server.
You don't need to, that's why you have cron jobs.


Quote:
Originally Posted by Babelduo View Post
How can I find out more about what happend at this time
The problem is Linux doesn't come with extensive logging enabled to provide you with a full audit trail on installation. If you need it you have to configure it beforehand.



Quote:
Originally Posted by Babelduo View Post
or which cron did this?
Recursively list and grep all cron job directories and crontab files (/etc/crontab, /etc/cron.*/, /var/cron/, /var/spool/cron, etc, etc) for any name or application hinting at any service checking or run the cron daemon in debug mode: '/path/to/crond -x sch,proc,test' (or 'crond -x sch,proc,test 2>&1 | tee | while read LINE; do echo "$(/bin/date +'%b %d %H:%M:%S hostname') crondebug ${LINE}"; done | tee /var/log/cron.debug' if you want to correlate things a wee bit easier). Note you should only use the latter if from your auth.log entries you have determined it is a job running at a low interval and you should not use ",test" on systems where you can not afford to not run jobs like production servers.


Quote:
Originally Posted by Babelduo View Post
p.s: sry I wanted to put this into Security!
Yeah, but I'll find it anyway ;-p *Next time use the report button on your post to ask a moderator to move your thread for you.
 
Old 08-22-2012, 04:06 PM   #3
Babelduo
LQ Newbie
 
Registered: Mar 2009
Posts: 12

Original Poster
Rep: Reputation: 0
Hi,

thank you! I managed to find out that this was related with stunnel. I tunnel ssh traffic through https on my server (to fool some company outgoing firewalls...). And this was some traffic from some bots that connected via stunnel/https to try yo find something... and that was transferred to sshd because of stunnel.

complicated

thx,
Kim
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Routing - cannot SSH to a server (Did not receive identification string) Jay2k1 Linux - Networking 0 07-21-2011 08:23 AM
socks server, problem with connecting using ssh protocol, hints welcome sarajevo Linux - Networking 1 12-12-2008 04:23 PM
Protect server from brute force attack via ssh babysparrow Linux - Security 6 03-31-2006 09:00 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 03:02 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration