Random IPs trying to get in

July 24, 2016 3.1k views
Security Monitoring


I created a droplet 2 months ago and I did the basic things like configuring the firewall, setup ssh to only accept public key auth and stuff.
Last night I was inspecting the logs located at /var/log/auth.log and /var/log/ufw.log and I noticed that there are a lot of IPs trying to access telnet, ssh (using brute force with random login names) and there are also some attempt to connect to some random TCP ports.

Should I be worried? Is this “normal” ?

Btw: My firewall is configure to drop all incoming packets (except ssh).

Thank you

2 Answers

You can improve and reduce the attack attempts by:

  • Disabling password passed authentication and using RSA SSH keys
  • Configurig your firewall and ssh to only allow your IP (you need to have a static IP)
  • Using 2FA, for example 2FA of Google
  • Changing the SSH port
  • Disable root Login via SSH
  • Using a software that prevents DDOS attacks like DenyHosts or fail2ban

This is to be expected. Disabling password based authentication in sshd_config makes this a non issue.

Have another answer? Share your knowledge.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!