Is there anything I can do if someone try to connect on my droplet?

September 10, 2018 772 views
Firewall Ubuntu
gilbeyruth
By:
gilbeyruth

I'm getting multiple tries to connect on my droplet from 211.251.237.142, is there any thing we can do?

It keeps trying with different users.

https://www.abuseipdb.com/check/211.251.237.142
Seems to be a Korean ip.

Sep 10 10:42:43 node-1506570992471-1gb-nyc1-01 sshd[6293]: Invalid user oracle from 211.251.237.142
Sep 10 10:42:43 node-1506570992471-1gb-nyc1-01 sshd[6293]: inputuserauthrequest: invalid user oracle [preauth]
Sep 10 10:42:44 node-1506570992471-1gb-nyc1-01 sshd[6293]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:42:46 node-1506570992471-1gb-nyc1-01 sshd[6295]: Invalid user oracle from 211.251.237.142
Sep 10 10:42:46 node-1506570992471-1gb-nyc1-01 sshd[6295]: inputuserauthrequest: invalid user oracle [preauth]
Sep 10 10:42:46 node-1506570992471-1gb-nyc1-01 sshd[6295]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:42:48 node-1506570992471-1gb-nyc1-01 sshd[6297]: Invalid user oracle from 211.251.237.142
Sep 10 10:42:48 node-1506570992471-1gb-nyc1-01 sshd[6297]: inputuserauthrequest: invalid user oracle [preauth]
Sep 10 10:42:48 node-1506570992471-1gb-nyc1-01 sshd[6297]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:42:50 node-1506570992471-1gb-nyc1-01 sshd[6299]: Invalid user oracle from 211.251.237.142
Sep 10 10:42:50 node-1506570992471-1gb-nyc1-01 sshd[6299]: inputuserauthrequest: invalid user oracle [preauth]
Sep 10 10:42:50 node-1506570992471-1gb-nyc1-01 sshd[6299]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:42:52 node-1506570992471-1gb-nyc1-01 sshd[6301]: Invalid user oracle from 211.251.237.142
Sep 10 10:42:52 node-1506570992471-1gb-nyc1-01 sshd[6301]: inputuserauthrequest: invalid user oracle [preauth]
Sep 10 10:42:52 node-1506570992471-1gb-nyc1-01 sshd[6301]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:42:54 node-1506570992471-1gb-nyc1-01 sshd[6303]: Invalid user nagios from 211.251.237.142
Sep 10 10:42:54 node-1506570992471-1gb-nyc1-01 sshd[6303]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:42:54 node-1506570992471-1gb-nyc1-01 sshd[6303]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:42:56 node-1506570992471-1gb-nyc1-01 sshd[6305]: Invalid user nagios from 211.251.237.142
Sep 10 10:42:56 node-1506570992471-1gb-nyc1-01 sshd[6305]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:42:56 node-1506570992471-1gb-nyc1-01 sshd[6305]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:42:58 node-1506570992471-1gb-nyc1-01 sshd[6307]: Invalid user nagios from 211.251.237.142
Sep 10 10:42:58 node-1506570992471-1gb-nyc1-01 sshd[6307]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:42:58 node-1506570992471-1gb-nyc1-01 sshd[6307]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:00 node-1506570992471-1gb-nyc1-01 sshd[6309]: Invalid user nagios from 211.251.237.142
Sep 10 10:43:00 node-1506570992471-1gb-nyc1-01 sshd[6309]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:43:00 node-1506570992471-1gb-nyc1-01 sshd[6309]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:02 node-1506570992471-1gb-nyc1-01 sshd[6311]: Invalid user nagios from 211.251.237.142
Sep 10 10:43:02 node-1506570992471-1gb-nyc1-01 sshd[6311]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:43:03 node-1506570992471-1gb-nyc1-01 sshd[6311]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:05 node-1506570992471-1gb-nyc1-01 sshd[6313]: Invalid user nagios from 211.251.237.142
Sep 10 10:43:05 node-1506570992471-1gb-nyc1-01 sshd[6313]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:43:05 node-1506570992471-1gb-nyc1-01 sshd[6313]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:07 node-1506570992471-1gb-nyc1-01 sshd[6315]: Invalid user nagios from 211.251.237.142
Sep 10 10:43:07 node-1506570992471-1gb-nyc1-01 sshd[6315]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:43:07 node-1506570992471-1gb-nyc1-01 sshd[6315]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:09 node-1506570992471-1gb-nyc1-01 sshd[6317]: Invalid user nagios from 211.251.237.142
Sep 10 10:43:09 node-1506570992471-1gb-nyc1-01 sshd[6317]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:43:09 node-1506570992471-1gb-nyc1-01 sshd[6317]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:11 node-1506570992471-1gb-nyc1-01 sshd[6319]: Invalid user nagios from 211.251.237.142
Sep 10 10:43:11 node-1506570992471-1gb-nyc1-01 sshd[6319]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:43:11 node-1506570992471-1gb-nyc1-01 sshd[6319]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:13 node-1506570992471-1gb-nyc1-01 sshd[6321]: Invalid user naigos from 211.251.237.142
Sep 10 10:43:13 node-1506570992471-1gb-nyc1-01 sshd[6321]: inputuserauthrequest: invalid user naigos [preauth]
Sep 10 10:43:13 node-1506570992471-1gb-nyc1-01 sshd[6321]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:15 node-1506570992471-1gb-nyc1-01 sshd[6323]: Invalid user nagios from 211.251.237.142
Sep 10 10:43:15 node-1506570992471-1gb-nyc1-01 sshd[6323]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:43:15 node-1506570992471-1gb-nyc1-01 sshd[6323]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:17 node-1506570992471-1gb-nyc1-01 sshd[6325]: Invalid user nagios from 211.251.237.142
Sep 10 10:43:17 node-1506570992471-1gb-nyc1-01 sshd[6325]: inputuserauthrequest: invalid user nagios [preauth]
Sep 10 10:43:17 node-1506570992471-1gb-nyc1-01 sshd[6325]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:19 node-1506570992471-1gb-nyc1-01 sshd[6327]: Invalid user git from 211.251.237.142
Sep 10 10:43:19 node-1506570992471-1gb-nyc1-01 sshd[6327]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:20 node-1506570992471-1gb-nyc1-01 sshd[6327]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:21 node-1506570992471-1gb-nyc1-01 sshd[6329]: Invalid user git from 211.251.237.142
Sep 10 10:43:21 node-1506570992471-1gb-nyc1-01 sshd[6329]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:22 node-1506570992471-1gb-nyc1-01 sshd[6329]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:23 node-1506570992471-1gb-nyc1-01 sshd[6331]: Invalid user git from 211.251.237.142
Sep 10 10:43:23 node-1506570992471-1gb-nyc1-01 sshd[6331]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:24 node-1506570992471-1gb-nyc1-01 sshd[6331]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:25 node-1506570992471-1gb-nyc1-01 sshd[6333]: Invalid user git from 211.251.237.142
Sep 10 10:43:25 node-1506570992471-1gb-nyc1-01 sshd[6333]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:25 node-1506570992471-1gb-nyc1-01 sshd[6333]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:27 node-1506570992471-1gb-nyc1-01 sshd[6335]: Invalid user git from 211.251.237.142
Sep 10 10:43:27 node-1506570992471-1gb-nyc1-01 sshd[6335]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:28 node-1506570992471-1gb-nyc1-01 sshd[6335]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:29 node-1506570992471-1gb-nyc1-01 sshd[6337]: Invalid user git from 211.251.237.142
Sep 10 10:43:29 node-1506570992471-1gb-nyc1-01 sshd[6337]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:30 node-1506570992471-1gb-nyc1-01 sshd[6337]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:31 node-1506570992471-1gb-nyc1-01 sshd[6339]: Invalid user git from 211.251.237.142
Sep 10 10:43:31 node-1506570992471-1gb-nyc1-01 sshd[6339]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:32 node-1506570992471-1gb-nyc1-01 sshd[6339]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:34 node-1506570992471-1gb-nyc1-01 sshd[6341]: Invalid user git from 211.251.237.142
Sep 10 10:43:34 node-1506570992471-1gb-nyc1-01 sshd[6341]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:34 node-1506570992471-1gb-nyc1-01 sshd[6341]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:36 node-1506570992471-1gb-nyc1-01 sshd[6343]: Invalid user git from 211.251.237.142
Sep 10 10:43:36 node-1506570992471-1gb-nyc1-01 sshd[6343]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:36 node-1506570992471-1gb-nyc1-01 sshd[6343]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:38 node-1506570992471-1gb-nyc1-01 sshd[6345]: Invalid user git from 211.251.237.142
Sep 10 10:43:38 node-1506570992471-1gb-nyc1-01 sshd[6345]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:38 node-1506570992471-1gb-nyc1-01 sshd[6345]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:40 node-1506570992471-1gb-nyc1-01 sshd[6347]: Invalid user git from 211.251.237.142
Sep 10 10:43:40 node-1506570992471-1gb-nyc1-01 sshd[6347]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:40 node-1506570992471-1gb-nyc1-01 sshd[6347]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:42 node-1506570992471-1gb-nyc1-01 sshd[6349]: Invalid user git from 211.251.237.142
Sep 10 10:43:42 node-1506570992471-1gb-nyc1-01 sshd[6349]: inputuserauthrequest: invalid user git [preauth]
Sep 10 10:43:42 node-1506570992471-1gb-nyc1-01 sshd[6349]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:44 node-1506570992471-1gb-nyc1-01 sshd[6351]: Invalid user postgres from 211.251.237.142
Sep 10 10:43:44 node-1506570992471-1gb-nyc1-01 sshd[6351]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:43:44 node-1506570992471-1gb-nyc1-01 sshd[6351]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:46 node-1506570992471-1gb-nyc1-01 sshd[6353]: Invalid user postgres from 211.251.237.142
Sep 10 10:43:46 node-1506570992471-1gb-nyc1-01 sshd[6353]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:43:46 node-1506570992471-1gb-nyc1-01 sshd[6353]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:48 node-1506570992471-1gb-nyc1-01 sshd[6355]: Invalid user postgres from 211.251.237.142
Sep 10 10:43:48 node-1506570992471-1gb-nyc1-01 sshd[6355]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:43:48 node-1506570992471-1gb-nyc1-01 sshd[6355]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:50 node-1506570992471-1gb-nyc1-01 sshd[6357]: Invalid user postgres from 211.251.237.142
Sep 10 10:43:50 node-1506570992471-1gb-nyc1-01 sshd[6357]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:43:51 node-1506570992471-1gb-nyc1-01 sshd[6357]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:52 node-1506570992471-1gb-nyc1-01 sshd[6359]: Invalid user postgres from 211.251.237.142
Sep 10 10:43:52 node-1506570992471-1gb-nyc1-01 sshd[6359]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:43:53 node-1506570992471-1gb-nyc1-01 sshd[6359]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:54 node-1506570992471-1gb-nyc1-01 sshd[6361]: Invalid user postgres from 211.251.237.142
Sep 10 10:43:54 node-1506570992471-1gb-nyc1-01 sshd[6361]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:43:55 node-1506570992471-1gb-nyc1-01 sshd[6361]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:56 node-1506570992471-1gb-nyc1-01 sshd[6363]: Invalid user postgres from 211.251.237.142
Sep 10 10:43:57 node-1506570992471-1gb-nyc1-01 sshd[6363]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:43:57 node-1506570992471-1gb-nyc1-01 sshd[6363]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:43:59 node-1506570992471-1gb-nyc1-01 sshd[6365]: Invalid user postgres from 211.251.237.142
Sep 10 10:43:59 node-1506570992471-1gb-nyc1-01 sshd[6365]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:43:59 node-1506570992471-1gb-nyc1-01 sshd[6365]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:44:01 node-1506570992471-1gb-nyc1-01 sshd[6367]: Invalid user postgres from 211.251.237.142
Sep 10 10:44:01 node-1506570992471-1gb-nyc1-01 sshd[6367]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:44:01 node-1506570992471-1gb-nyc1-01 sshd[6367]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:44:03 node-1506570992471-1gb-nyc1-01 sshd[6369]: Invalid user postgres from 211.251.237.142
Sep 10 10:44:03 node-1506570992471-1gb-nyc1-01 sshd[6369]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:44:03 node-1506570992471-1gb-nyc1-01 sshd[6369]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:44:05 node-1506570992471-1gb-nyc1-01 sshd[6371]: Invalid user postgres from 211.251.237.142
Sep 10 10:44:05 node-1506570992471-1gb-nyc1-01 sshd[6371]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:44:05 node-1506570992471-1gb-nyc1-01 sshd[6371]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:44:07 node-1506570992471-1gb-nyc1-01 sshd[6373]: Invalid user postgres from 211.251.237.142
Sep 10 10:44:07 node-1506570992471-1gb-nyc1-01 sshd[6373]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:44:08 node-1506570992471-1gb-nyc1-01 sshd[6373]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:44:09 node-1506570992471-1gb-nyc1-01 sshd[6375]: Invalid user postgres from 211.251.237.142
Sep 10 10:44:09 node-1506570992471-1gb-nyc1-01 sshd[6375]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:44:10 node-1506570992471-1gb-nyc1-01 sshd[6375]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:44:11 node-1506570992471-1gb-nyc1-01 sshd[6377]: Invalid user postgres from 211.251.237.142
Sep 10 10:44:11 node-1506570992471-1gb-nyc1-01 sshd[6377]: inputuserauthrequest: invalid user postgres [preauth]
Sep 10 10:44:11 node-1506570992471-1gb-nyc1-01 sshd[6377]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:44:13 node-1506570992471-1gb-nyc1-01 sshd[6379]: Invalid user admin from 211.251.237.142
Sep 10 10:44:13 node-1506570992471-1gb-nyc1-01 sshd[6379]: inputuserauthrequest: invalid user admin [preauth]
Sep 10 10:44:14 node-1506570992471-1gb-nyc1-01 sshd[6379]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:44:15 node-1506570992471-1gb-nyc1-01 sshd[6381]: Invalid user admin from 211.251.237.142
Sep 10 10:44:15 node-1506570992471-1gb-nyc1-01 sshd[6381]: inputuserauthrequest: invalid user admin [preauth]
Sep 10 10:44:16 node-1506570992471-1gb-nyc1-01 sshd[6381]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
Sep 10 10:44:18 node-1506570992471-1gb-nyc1-01 sshd[6383]: Invalid user admin from 211.251.237.142
Sep 10 10:44:18 node-1506570992471-1gb-nyc1-01 sshd[6383]: inputuserauthrequest: invalid user admin [preauth]
Sep 10 10:44:18 node-1506570992471-1gb-nyc1-01 sshd[6383]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]

2 comments
Log In to Comment
2 Answers
jarland MOD September 10, 2018

Hey friend!

There are things you can do, and you can block the IP, but I would encourage a different perspective on this. Let me start by example.

I have a server that receives reasonable amounts of traffic. As of right now, in the month of September thus far, there have been 10,669 failed logins by people with malicious intentions, compromised servers being used automatically for malicious purpose, etc. The reason for it is simple: IPv4 address space is limited and easily calculated, and I can (if I wanted to, I don't) distribute malware that infects thousands of computers around the world and sets them loose to try to compromise even more computers by attempting to log in to them and add them to the list of infected machines. By having an IP address and being connected to the internet, you are a target and there's nothing you can do to change that.

The perspective I want to encourage is that this is normal and simply part of being on the internet. Blocking IPs would typically be the wrong approach. Think of blocking IPs like this: You hire someone to stand outside of your door with a list of people not to let in. That means anyone not on that list is welcome to walk past them. Rarely are you going to see the same person more than one day in a month, and the list grows so long that it takes the person you hired longer and longer to read it. The list and the person you hired have just become excess overhead that fail to reduce the actual volume of people walking in the door.

Building on that illustration, the real solution is to put a lock on your door and keep the key on you. Let any amount of people walk up to the door and try to turn the knob, but keep the door locked so they eventually have to give up and walk away. The only overhead for you is that you have to put a key in the lock to walk inside.

Taking that illustration into reality, the answer that I'm pointing to is to use SSH keys. Here's a guide for creating/deploying them using a Windows client:

https://www.tecmint.com/ssh-passwordless-login-with-putty/

Additionally, if you set "PermitRootLogin" to "without-password" in /etc/ssh/sshd_config, they can just try passwords all day long and you can just watch and smile :)

Jarland

Reply
  • gilbeyruth September 10, 2018

    Thanks for the answer, I already have 2 step auth on those servers, I also added a firewall and blocked those ips for ssh port, and the username on ssh is not the default, so they will keep on trying forever without knowing the username, nor the pass, nor the authcode, and now will hit the firewall.

    Do you know if ssh key can work together with 2 step auth?

saifnirob September 10, 2018

Did you try SSH Passphrase? This could make another wall in terms of security issue. And I believe you already disabled permission to log in from a different user than what you only permitted.

Reply
  • gilbeyruth September 17, 2018

    Yes, I have disabled root access from ssh, created another user for that, changed the ssh port number, and added 2 step verification with google autheticator, now I don't see any more tries on logs. Thanks.

Have another answer? Share your knowledge.

Related Questions