By Gil Beyruth
I’m getting multiple tries to connect on my droplet from 211.251.237.142, is there any thing we can do?
It keeps trying with different users.
https://www.abuseipdb.com/check/211.251.237.142 Seems to be a Korean ip.
Sep 10 10:42:43 node-1506570992471-1gb-nyc1-01 sshd[6293]: Invalid user oracle from 211.251.237.142 Sep 10 10:42:43 node-1506570992471-1gb-nyc1-01 sshd[6293]: input_userauth_request: invalid user oracle [preauth] Sep 10 10:42:44 node-1506570992471-1gb-nyc1-01 sshd[6293]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:42:46 node-1506570992471-1gb-nyc1-01 sshd[6295]: Invalid user oracle from 211.251.237.142 Sep 10 10:42:46 node-1506570992471-1gb-nyc1-01 sshd[6295]: input_userauth_request: invalid user oracle [preauth] Sep 10 10:42:46 node-1506570992471-1gb-nyc1-01 sshd[6295]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:42:48 node-1506570992471-1gb-nyc1-01 sshd[6297]: Invalid user oracle from 211.251.237.142 Sep 10 10:42:48 node-1506570992471-1gb-nyc1-01 sshd[6297]: input_userauth_request: invalid user oracle [preauth] Sep 10 10:42:48 node-1506570992471-1gb-nyc1-01 sshd[6297]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:42:50 node-1506570992471-1gb-nyc1-01 sshd[6299]: Invalid user oracle from 211.251.237.142 Sep 10 10:42:50 node-1506570992471-1gb-nyc1-01 sshd[6299]: input_userauth_request: invalid user oracle [preauth] Sep 10 10:42:50 node-1506570992471-1gb-nyc1-01 sshd[6299]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:42:52 node-1506570992471-1gb-nyc1-01 sshd[6301]: Invalid user oracle from 211.251.237.142 Sep 10 10:42:52 node-1506570992471-1gb-nyc1-01 sshd[6301]: input_userauth_request: invalid user oracle [preauth] Sep 10 10:42:52 node-1506570992471-1gb-nyc1-01 sshd[6301]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:42:54 node-1506570992471-1gb-nyc1-01 sshd[6303]: Invalid user nagios from 211.251.237.142 Sep 10 10:42:54 node-1506570992471-1gb-nyc1-01 sshd[6303]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:42:54 node-1506570992471-1gb-nyc1-01 sshd[6303]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:42:56 node-1506570992471-1gb-nyc1-01 sshd[6305]: Invalid user nagios from 211.251.237.142 Sep 10 10:42:56 node-1506570992471-1gb-nyc1-01 sshd[6305]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:42:56 node-1506570992471-1gb-nyc1-01 sshd[6305]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:42:58 node-1506570992471-1gb-nyc1-01 sshd[6307]: Invalid user nagios from 211.251.237.142 Sep 10 10:42:58 node-1506570992471-1gb-nyc1-01 sshd[6307]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:42:58 node-1506570992471-1gb-nyc1-01 sshd[6307]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:00 node-1506570992471-1gb-nyc1-01 sshd[6309]: Invalid user nagios from 211.251.237.142 Sep 10 10:43:00 node-1506570992471-1gb-nyc1-01 sshd[6309]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:43:00 node-1506570992471-1gb-nyc1-01 sshd[6309]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:02 node-1506570992471-1gb-nyc1-01 sshd[6311]: Invalid user nagios from 211.251.237.142 Sep 10 10:43:02 node-1506570992471-1gb-nyc1-01 sshd[6311]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:43:03 node-1506570992471-1gb-nyc1-01 sshd[6311]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:05 node-1506570992471-1gb-nyc1-01 sshd[6313]: Invalid user nagios from 211.251.237.142 Sep 10 10:43:05 node-1506570992471-1gb-nyc1-01 sshd[6313]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:43:05 node-1506570992471-1gb-nyc1-01 sshd[6313]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:07 node-1506570992471-1gb-nyc1-01 sshd[6315]: Invalid user nagios from 211.251.237.142 Sep 10 10:43:07 node-1506570992471-1gb-nyc1-01 sshd[6315]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:43:07 node-1506570992471-1gb-nyc1-01 sshd[6315]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:09 node-1506570992471-1gb-nyc1-01 sshd[6317]: Invalid user nagios from 211.251.237.142 Sep 10 10:43:09 node-1506570992471-1gb-nyc1-01 sshd[6317]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:43:09 node-1506570992471-1gb-nyc1-01 sshd[6317]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:11 node-1506570992471-1gb-nyc1-01 sshd[6319]: Invalid user nagios from 211.251.237.142 Sep 10 10:43:11 node-1506570992471-1gb-nyc1-01 sshd[6319]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:43:11 node-1506570992471-1gb-nyc1-01 sshd[6319]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:13 node-1506570992471-1gb-nyc1-01 sshd[6321]: Invalid user naigos from 211.251.237.142 Sep 10 10:43:13 node-1506570992471-1gb-nyc1-01 sshd[6321]: input_userauth_request: invalid user naigos [preauth] Sep 10 10:43:13 node-1506570992471-1gb-nyc1-01 sshd[6321]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:15 node-1506570992471-1gb-nyc1-01 sshd[6323]: Invalid user nagios from 211.251.237.142 Sep 10 10:43:15 node-1506570992471-1gb-nyc1-01 sshd[6323]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:43:15 node-1506570992471-1gb-nyc1-01 sshd[6323]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:17 node-1506570992471-1gb-nyc1-01 sshd[6325]: Invalid user nagios from 211.251.237.142 Sep 10 10:43:17 node-1506570992471-1gb-nyc1-01 sshd[6325]: input_userauth_request: invalid user nagios [preauth] Sep 10 10:43:17 node-1506570992471-1gb-nyc1-01 sshd[6325]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:19 node-1506570992471-1gb-nyc1-01 sshd[6327]: Invalid user git from 211.251.237.142 Sep 10 10:43:19 node-1506570992471-1gb-nyc1-01 sshd[6327]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:20 node-1506570992471-1gb-nyc1-01 sshd[6327]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:21 node-1506570992471-1gb-nyc1-01 sshd[6329]: Invalid user git from 211.251.237.142 Sep 10 10:43:21 node-1506570992471-1gb-nyc1-01 sshd[6329]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:22 node-1506570992471-1gb-nyc1-01 sshd[6329]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:23 node-1506570992471-1gb-nyc1-01 sshd[6331]: Invalid user git from 211.251.237.142 Sep 10 10:43:23 node-1506570992471-1gb-nyc1-01 sshd[6331]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:24 node-1506570992471-1gb-nyc1-01 sshd[6331]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:25 node-1506570992471-1gb-nyc1-01 sshd[6333]: Invalid user git from 211.251.237.142 Sep 10 10:43:25 node-1506570992471-1gb-nyc1-01 sshd[6333]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:25 node-1506570992471-1gb-nyc1-01 sshd[6333]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:27 node-1506570992471-1gb-nyc1-01 sshd[6335]: Invalid user git from 211.251.237.142 Sep 10 10:43:27 node-1506570992471-1gb-nyc1-01 sshd[6335]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:28 node-1506570992471-1gb-nyc1-01 sshd[6335]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:29 node-1506570992471-1gb-nyc1-01 sshd[6337]: Invalid user git from 211.251.237.142 Sep 10 10:43:29 node-1506570992471-1gb-nyc1-01 sshd[6337]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:30 node-1506570992471-1gb-nyc1-01 sshd[6337]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:31 node-1506570992471-1gb-nyc1-01 sshd[6339]: Invalid user git from 211.251.237.142 Sep 10 10:43:31 node-1506570992471-1gb-nyc1-01 sshd[6339]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:32 node-1506570992471-1gb-nyc1-01 sshd[6339]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:34 node-1506570992471-1gb-nyc1-01 sshd[6341]: Invalid user git from 211.251.237.142 Sep 10 10:43:34 node-1506570992471-1gb-nyc1-01 sshd[6341]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:34 node-1506570992471-1gb-nyc1-01 sshd[6341]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:36 node-1506570992471-1gb-nyc1-01 sshd[6343]: Invalid user git from 211.251.237.142 Sep 10 10:43:36 node-1506570992471-1gb-nyc1-01 sshd[6343]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:36 node-1506570992471-1gb-nyc1-01 sshd[6343]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:38 node-1506570992471-1gb-nyc1-01 sshd[6345]: Invalid user git from 211.251.237.142 Sep 10 10:43:38 node-1506570992471-1gb-nyc1-01 sshd[6345]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:38 node-1506570992471-1gb-nyc1-01 sshd[6345]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:40 node-1506570992471-1gb-nyc1-01 sshd[6347]: Invalid user git from 211.251.237.142 Sep 10 10:43:40 node-1506570992471-1gb-nyc1-01 sshd[6347]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:40 node-1506570992471-1gb-nyc1-01 sshd[6347]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:42 node-1506570992471-1gb-nyc1-01 sshd[6349]: Invalid user git from 211.251.237.142 Sep 10 10:43:42 node-1506570992471-1gb-nyc1-01 sshd[6349]: input_userauth_request: invalid user git [preauth] Sep 10 10:43:42 node-1506570992471-1gb-nyc1-01 sshd[6349]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:44 node-1506570992471-1gb-nyc1-01 sshd[6351]: Invalid user postgres from 211.251.237.142 Sep 10 10:43:44 node-1506570992471-1gb-nyc1-01 sshd[6351]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:43:44 node-1506570992471-1gb-nyc1-01 sshd[6351]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:46 node-1506570992471-1gb-nyc1-01 sshd[6353]: Invalid user postgres from 211.251.237.142 Sep 10 10:43:46 node-1506570992471-1gb-nyc1-01 sshd[6353]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:43:46 node-1506570992471-1gb-nyc1-01 sshd[6353]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:48 node-1506570992471-1gb-nyc1-01 sshd[6355]: Invalid user postgres from 211.251.237.142 Sep 10 10:43:48 node-1506570992471-1gb-nyc1-01 sshd[6355]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:43:48 node-1506570992471-1gb-nyc1-01 sshd[6355]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:50 node-1506570992471-1gb-nyc1-01 sshd[6357]: Invalid user postgres from 211.251.237.142 Sep 10 10:43:50 node-1506570992471-1gb-nyc1-01 sshd[6357]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:43:51 node-1506570992471-1gb-nyc1-01 sshd[6357]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:52 node-1506570992471-1gb-nyc1-01 sshd[6359]: Invalid user postgres from 211.251.237.142 Sep 10 10:43:52 node-1506570992471-1gb-nyc1-01 sshd[6359]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:43:53 node-1506570992471-1gb-nyc1-01 sshd[6359]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:54 node-1506570992471-1gb-nyc1-01 sshd[6361]: Invalid user postgres from 211.251.237.142 Sep 10 10:43:54 node-1506570992471-1gb-nyc1-01 sshd[6361]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:43:55 node-1506570992471-1gb-nyc1-01 sshd[6361]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:56 node-1506570992471-1gb-nyc1-01 sshd[6363]: Invalid user postgres from 211.251.237.142 Sep 10 10:43:57 node-1506570992471-1gb-nyc1-01 sshd[6363]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:43:57 node-1506570992471-1gb-nyc1-01 sshd[6363]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:43:59 node-1506570992471-1gb-nyc1-01 sshd[6365]: Invalid user postgres from 211.251.237.142 Sep 10 10:43:59 node-1506570992471-1gb-nyc1-01 sshd[6365]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:43:59 node-1506570992471-1gb-nyc1-01 sshd[6365]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:44:01 node-1506570992471-1gb-nyc1-01 sshd[6367]: Invalid user postgres from 211.251.237.142 Sep 10 10:44:01 node-1506570992471-1gb-nyc1-01 sshd[6367]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:44:01 node-1506570992471-1gb-nyc1-01 sshd[6367]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:44:03 node-1506570992471-1gb-nyc1-01 sshd[6369]: Invalid user postgres from 211.251.237.142 Sep 10 10:44:03 node-1506570992471-1gb-nyc1-01 sshd[6369]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:44:03 node-1506570992471-1gb-nyc1-01 sshd[6369]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:44:05 node-1506570992471-1gb-nyc1-01 sshd[6371]: Invalid user postgres from 211.251.237.142 Sep 10 10:44:05 node-1506570992471-1gb-nyc1-01 sshd[6371]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:44:05 node-1506570992471-1gb-nyc1-01 sshd[6371]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:44:07 node-1506570992471-1gb-nyc1-01 sshd[6373]: Invalid user postgres from 211.251.237.142 Sep 10 10:44:07 node-1506570992471-1gb-nyc1-01 sshd[6373]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:44:08 node-1506570992471-1gb-nyc1-01 sshd[6373]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:44:09 node-1506570992471-1gb-nyc1-01 sshd[6375]: Invalid user postgres from 211.251.237.142 Sep 10 10:44:09 node-1506570992471-1gb-nyc1-01 sshd[6375]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:44:10 node-1506570992471-1gb-nyc1-01 sshd[6375]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:44:11 node-1506570992471-1gb-nyc1-01 sshd[6377]: Invalid user postgres from 211.251.237.142 Sep 10 10:44:11 node-1506570992471-1gb-nyc1-01 sshd[6377]: input_userauth_request: invalid user postgres [preauth] Sep 10 10:44:11 node-1506570992471-1gb-nyc1-01 sshd[6377]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:44:13 node-1506570992471-1gb-nyc1-01 sshd[6379]: Invalid user admin from 211.251.237.142 Sep 10 10:44:13 node-1506570992471-1gb-nyc1-01 sshd[6379]: input_userauth_request: invalid user admin [preauth] Sep 10 10:44:14 node-1506570992471-1gb-nyc1-01 sshd[6379]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:44:15 node-1506570992471-1gb-nyc1-01 sshd[6381]: Invalid user admin from 211.251.237.142 Sep 10 10:44:15 node-1506570992471-1gb-nyc1-01 sshd[6381]: input_userauth_request: invalid user admin [preauth] Sep 10 10:44:16 node-1506570992471-1gb-nyc1-01 sshd[6381]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth] Sep 10 10:44:18 node-1506570992471-1gb-nyc1-01 sshd[6383]: Invalid user admin from 211.251.237.142 Sep 10 10:44:18 node-1506570992471-1gb-nyc1-01 sshd[6383]: input_userauth_request: invalid user admin [preauth] Sep 10 10:44:18 node-1506570992471-1gb-nyc1-01 sshd[6383]: Received disconnect from 211.251.237.142: 11: Bye Bye [preauth]
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Did you try SSH Passphrase? This could make another wall in terms of security issue. And I believe you already disabled permission to log in from a different user than what you only permitted.
Hey friend!
There are things you can do, and you can block the IP, but I would encourage a different perspective on this. Let me start by example.
I have a server that receives reasonable amounts of traffic. As of right now, in the month of September thus far, there have been 10,669 failed logins by people with malicious intentions, compromised servers being used automatically for malicious purpose, etc. The reason for it is simple: IPv4 address space is limited and easily calculated, and I can (if I wanted to, I don’t) distribute malware that infects thousands of computers around the world and sets them loose to try to compromise even more computers by attempting to log in to them and add them to the list of infected machines. By having an IP address and being connected to the internet, you are a target and there’s nothing you can do to change that.
The perspective I want to encourage is that this is normal and simply part of being on the internet. Blocking IPs would typically be the wrong approach. Think of blocking IPs like this: You hire someone to stand outside of your door with a list of people not to let in. That means anyone not on that list is welcome to walk past them. Rarely are you going to see the same person more than one day in a month, and the list grows so long that it takes the person you hired longer and longer to read it. The list and the person you hired have just become excess overhead that fail to reduce the actual volume of people walking in the door.
Building on that illustration, the real solution is to put a lock on your door and keep the key on you. Let any amount of people walk up to the door and try to turn the knob, but keep the door locked so they eventually have to give up and walk away. The only overhead for you is that you have to put a key in the lock to walk inside.
Taking that illustration into reality, the answer that I’m pointing to is to use SSH keys. Here’s a guide for creating/deploying them using a Windows client:
https://www.tecmint.com/ssh-passwordless-login-with-putty/
Additionally, if you set “PermitRootLogin” to “without-password” in /etc/ssh/sshd_config, they can just try passwords all day long and you can just watch and smile :)
Jarland
Hello there,
I come up across this question in 2023 and want to leave a tech talk on how you can secure your droplet and recommended Security Measures to Protect Your Servers
https://www.digitalocean.com/community/tech-talks/securing-your-droplet
Hope that this helps!
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.