Hello! I found a strange activity at my var/log/auth.log
Looks like somebody would like to break my account
For example:
Address 89.248.168.35 maps to no-reverse-dns-configured.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
There are a lot of such records in this log. How can I solve this problem or how can I be sure that my account is protected?
Hey there,
To mimic what @gndo mentioned, fail2ban or csf can be used to automatically block these attempts.
You can also edit your /etc/ssh/sshd_config file and change the Port line to something other than 22. For example you could change it to 2222 or 9022. After editing that file, you’d want to restart sshd with a service ssh restart. This suggestion does not increase security, but lessens the login attempts and helps to keep the logs and firewall rules cleaner.
NOTE: If you install an adaptive firewall like fail2ban or are blocking ports with your software firewall, you will want to make sure you open up access to your new SSH port.
Happy coding,
Jon Schwenn
Platform Support Specialist
DigitalOcean
To the left of that log entry should be the process that detected the connection attempt, probably ’sshd’.
I’m not familiar with the Security Distribution, but that probably includes the ’fail2ban’ package which can help reduce failed attempts like the ones you see. You can tweak the configuration to be more restrictive, but make sure you can always log in to the DO console else you might accidentally lock yourself out for a while.
To check if you have fail2ban:
Search the Tutorials section for how to tweak the configuration of fail2ban.