Britec Tech Support Forum

Hello All!

I have been seeing the following output after doing a service ssh status:


Question is: how in the world do I correct the ssh system so that I will not have people failing passwords trying to login as root: I have disabled root login, but I may have a problem with /etc/ssh/sshd_config - how can I read the information and stop these attempts? I may need to block these IP addresses from accessing BBUS, but I need to be able to READ the information - I don't think that I have ever seen the ssh service give me these warnings - Is this Normal? Do I have anything to worry about - I don't want to have someone try to bring me down......

Any help or advice is appreciated!

Thank You!

Brian

Looks like the first part of a Chinese IP brute forcing your password(s).

(02-22-2017, 10:21 PM)GuiltySpark Wrote: [ -> ]Looks like the first part of a Chinese IP brute forcing your password(s).

GuiltySpark:

I have added the following IPs to the ipset program

Then I checked service ssh status as root and got this:

How should I proceed to BLOCK these IP's and make them stop trying to hit me? There appears to be a disconnect from each IP, but I cant use the -I option or it errored out - I may be using the improper syntax, but I wish there was a way to automatically add these rouge addresses to the firewall iptables rules for the ports too, and then add it to ipset

I await your response

Brian

What are you using to block the IP's?

Do you have any firewalls set up like IPfire or portsentry?

Edit: just noticed you have a Chinese member apparently, is this correct?

GuiltySpark:

To my knowledge, I do NOT have any Chinese members that would have an account on my server. I would like to block a whole string of ips, but I do not know how to do it effectively. It looks like they are trying to use SSH2 to get in, but I cannot seem to add that protocol.

I am using ipset and iptables to add the ips to ipset's blacklist file, and also using Iptables to add that protection.'

I am not using a Linux firewall, but my netgear router has the proper setup for allowing me to connect to my server and other machines.

How should I proceed?

Brian

Have a look at this:

https://linux-audit.com/blocking-ip-addresses-in-linux-with-iptables/

It should tell you how to setup ipset correctly.

GuiltySpark:

I will take a look at this: Thank you for the information

Brian

---

GuiltySpark:

Is there a way to block something like this

221.194.44.*
221.194.231.*

etc This way I can try to take out the whole 221.194. range for example.

Brian

I don't think you can create a wildcard such as 192.224.* which would block that entire range. Instead you may have to create a hash:net list.

This site might help better understand it:

https://xmodulo.com/block-unwanted-ip-addresses-linux.html

(02-22-2017, 11:59 PM)GuiltySpark Wrote: [ -> ]I don't think you can create a wildcard such as 192.224.* which would block that entire range. Instead you may have to create a hash:net list.

This site might help better understand it:

https://xmodulo.com/block-unwanted-ip-addresses-linux.html

GuiltySpark:

I was able to install Fail2ban, and I am getting a log from /var/log/fail2ban.log - It seems as if it only bans for maybe a day, but with the number of attempts, I would like to make it a WEEK - If I extend the bantime to a week, I will hopefully be able to stop some of these stupid attempts - If I do a 'sudo iptables -L I Get:

[Note: I only gave you a sample of the listing:  Here is a fail2ban log:]



Here is /var/log/auth.log

and iptables-S

I just have to be able to enable the other jails and make sure that they work: [http/https: ddos] as you can see, it looks like it is working -But I want to extend the ban time for the offenders, and then to log the attempts with appropriate files.  Problem is, that if I have to add an IP to iptables each time, a 'sudo iptables -L' would generate a list probably longer then my arm - However, I am pleased to report that, for the most part, it seems to work - If I can figure out log rotation, I think that would be awesome

(btw:  root access logins have been disabled with a 'PermitRootLogin no' in sshd_config) I will only use sudo to do this

I just want to make sure that enabling jails in jail.local does not break the fail2ban service.

Thank You for your help!

Brian

Having never used fail2ban I'm not sure what it is / is not capable of. Will have to do some checking and get back to you.