Question
Strang activity at auth.log (POSSIBLE BREAK-IN ATTEMPT)
Hello! I found a strange activity at my var/log/auth.log
Looks like somebody would like to break my account
For example:
Address 89.248.168.35 maps to no-reverse-dns-configured.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
There are a lot of such records in this log. How can I solve this problem or how can I be sure that my account is protected?
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
To the left of that log entry should be the process that detected the connection attempt, probably ’sshd’.
I’m not familiar with the Security Distribution, but that probably includes the ’fail2ban’ package which can help reduce failed attempts like the ones you see. You can tweak the configuration to be more restrictive, but make sure you can always log in to the DO console else you might accidentally lock yourself out for a while.
To check if you have fail2ban:
Search the Tutorials section for how to tweak the configuration of fail2ban.