Related

Join the DigitalOcean Community Community

Join 1M+ other developers and:

  • Get help and share knowledge in Q&A
  • Subscribe to topics of interest
  • Get courses & tools that help you grow as a developer or small business owner
 Join Now
Is it possible to use full disk encryption on an Ubuntu 14 droplet? Question Question
going around in circles trying to setup Ubuntu Question Question

Question

Strang activity at auth.log (POSSIBLE BREAK-IN ATTEMPT)

Posted February 13, 2016 3.6k views
UbuntuSecurity

Hello! I found a strange activity at my var/log/auth.log
Looks like somebody would like to break my account
For example:
Address 89.248.168.35 maps to no-reverse-dns-configured.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

There are a lot of such records in this log. How can I solve this problem or how can I be sure that my account is protected?

Add a comment
miketm
By:
miketm

Related

Join the DigitalOcean Community Community

Join 1M+ other developers and:

  • Get help and share knowledge in Q&A
  • Subscribe to topics of interest
  • Get courses & tools that help you grow as a developer or small business owner
 Join Now
Is it possible to use full disk encryption on an Ubuntu 14 droplet? Question Question
going around in circles trying to setup Ubuntu Question Question
Add a comment
1 comment
  • gndo February 13, 2016
    Reply Report

    To the left of that log entry should be the process that detected the connection attempt, probably ’sshd’.
    I’m not familiar with the Security Distribution, but that probably includes the ’fail2ban’ package which can help reduce failed attempts like the ones you see. You can tweak the configuration to be more restrictive, but make sure you can always log in to the DO console else you might accidentally lock yourself out for a while.
    To check if you have fail2ban:

    dpkg -s fail2ban | grep "^Status"

    Search the Tutorials section for how to tweak the configuration of fail2ban.

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
Submit an Answer
1 answer
jschwenn February 14, 2016

Hey there,

To mimic what @gndo mentioned, fail2ban or csf can be used to automatically block these attempts.

You can also edit your /etc/ssh/sshd_config file and change the Port line to something other than 22. For example you could change it to 2222 or 9022. After editing that file, you’d want to restart sshd with a service ssh restart. This suggestion does not increase security, but lessens the login attempts and helps to keep the logs and firewall rules cleaner.

NOTE: If you install an adaptive firewall like fail2ban or are blocking ports with your software firewall, you will want to make sure you open up access to your new SSH port.

Happy coding,

Jon Schwenn
Platform Support Specialist
DigitalOcean

How To Install and Configure Config Server Firewall (CSF) on Ubuntu
by Lassi Ruonavaara
Config Server Firewall (CSF) is a free and advanced firewall for most Linux distributions and Linux based VPS. Learn how to install and configure on Ubuntu.
Reply Report

Related

Looking for something else?

Ask a new question Search for more help