Question
There were 445 failed login attempts since the last successful login.
- Posted on September 21, 2015
- Linux BasicsVPN
Asked by Nay
I just create a new droplet a few minutes ago, I installed nginx and setup SSH keys to conect through PuTTY, and for my surprise when I login in my SSH Console, in the message I get:
“There were 445 failed login attempts since the last successful login.”
It is very strange to me, I create my droplet a few minute ago, It will be any hacker with bruteforce trying a invasion??
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Want to learn more? Join the DigitalOcean Community!
Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.
Yes, bruteforcing SSH is very common. Disable password authentication and use public keys.
Sounds like you should take care of a few things. If you are using SSH keys, remove password login. Then install Fail2ban.
in /etc/ssh/sshd_config change the following lines so they match this: ChallengeResponseAuthentication no PasswordAuthentication no
Then follow the steps in the “Configuring a Basic Firewall” section here - https://www.digitalocean.com/community/tutorials/additional-recommended-steps-for-new-ubuntu-14-04-servers
Then install Fail2ban - https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-14-04
This is all assuming you are using Ubuntu 14.04