HN Explorer

Chinese hacking attempt/Secure your Servers

1 points by shamsulbuddy ↗ HN
I just have reinstalled Debian 7 on my VPS. Logged in for the first time with "root" and on port 22..then I didn't locked down anything and within an hour I can see the below root password breaking attempt in /var/log/auth.log file .. WHOIS shows its an Chinese IP. God knows when these people will get rid of Script kiddies. Now I have locked down my VPS... does anybody else have similar story and what best steps you took to Secure your Servers .??

Jan 24 02:28:30 Sputnik sshd[1566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.189.239.126 user=root Jan 24 02:28:32 Sputnik sshd[1566]: Failed password for root from 222.189.239.126 port 1616 ssh2 Jan 24 02:28:35 Sputnik sshd[1566]: Failed password for root from 222.189.239.126 port 1616 ssh2 Jan 24 02:28:37 Sputnik sshd[1566]: Failed password for root from 222.189.239.126 port 1616 ssh2 Jan 24 02:28:39 Sputnik sshd[1566]: Failed password for root from 222.189.239.126 port 1616 ssh2 Jan 24 02:28:41 Sputnik sshd[1566]: Failed password for root from 222.189.239.126 port 1616 ssh2 Jan 24 02:28:43 Sputnik sshd[1566]: Failed password for root from 222.189.239.126 port 1616 ssh2 Jan 24 02:28:43 Sputnik sshd[1566]: Disconnecting: Too many authentication failures for root [preauth] Jan 24 02:28:43 Sputnik sshd[1566]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.189.239.126 user=root Jan 24 02:28:43 Sputnik sshd[1566]: PAM service(sshd) ignoring max retries; 6 > 3

3 comments

[ 4.7 ms ] story [ 16.2 ms ] thread
jlgaddis
Hackers will attempt brute force attacks on unprotected SSH servers. News at 11.
yaeger
What exactly does "unprotected" mean in this context? I mean ssh means secure shell, so shouldn't the ssh be secure from the start? Or, a better question, what would you need to do to secure your server and why aren't these steps "on" by default?

I mean, even any new WiFi router you set up comes with WPA enabled by default. Wasn't always this way. I still remember setting up routers where the password protection was an afterthought.

But ssh isn't really that new is it? Should these security measures be default at least by now?

shamsulbuddy
Few basic things which can be done is like .. install Fail2ban , change the default SSH port to something else, and use PermitRootlogin as No in sshd_config file