Strang activity at auth.log (POSSIBLE BREAK-IN ATTEMPT)

Posted February 13, 2016 3.9k views

Hello! I found a strange activity at my var/log/auth.log
Looks like somebody would like to break my account
For example:
Address maps to, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

There are a lot of such records in this log. How can I solve this problem or how can I be sure that my account is protected?

1 comment
  • To the left of that log entry should be the process that detected the connection attempt, probably ’sshd’.
    I’m not familiar with the Security Distribution, but that probably includes the ’fail2ban’ package which can help reduce failed attempts like the ones you see. You can tweak the configuration to be more restrictive, but make sure you can always log in to the DO console else you might accidentally lock yourself out for a while.
    To check if you have fail2ban:

    dpkg -s fail2ban | grep "^Status"

    Search the Tutorials section for how to tweak the configuration of fail2ban.

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
1 answer

Hey there,

To mimic what @gndo mentioned, fail2ban or csf can be used to automatically block these attempts.

You can also edit your /etc/ssh/sshd_config file and change the Port line to something other than 22. For example you could change it to 2222 or 9022. After editing that file, you’d want to restart sshd with a service ssh restart. This suggestion does not increase security, but lessens the login attempts and helps to keep the logs and firewall rules cleaner.

NOTE: If you install an adaptive firewall like fail2ban or are blocking ports with your software firewall, you will want to make sure you open up access to your new SSH port.

Happy coding,

Jon Schwenn
Platform Support Specialist

by Lassi Ruonavaara
Config Server Firewall (CSF) is a free and advanced firewall for most Linux distributions and Linux based VPS. Learn how to install and configure on Ubuntu.