Pauls Big Linux Blog

So I often glance at the system logs of my proxmox vms / servers – it’s great fun watching the hack attempts and you will get a lot.

Today I was looking and I saw this:-

Feb 08 16:32:57 ds11104 sshd[2981176]: Failed password for invalid user admin from 185.217.0.127 port 1615 ssh2
Feb 08 16:32:58 ds11104 sshd[2981256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.7.17.61 user=root
Feb 08 16:33:00 ds11104 sshd[2981256]: Failed password for root from 189.7.17.61 port 41925 ssh2
Feb 08 16:33:02 ds11104 sshd[2981256]: Received disconnect from 189.7.17.61 port 41925:11: Bye Bye [preauth]
Feb 08 16:33:02 ds11104 sshd[2981256]: Disconnected from authenticating user root 189.7.17.61 port 41925 [preauth]
Feb 08 16:33:06 ds11104 sshd[2981176]: pam_unix(sshd:auth): check pass; user unknown
Feb 08 16:33:08 ds11104 sshd[2981176]: Failed password for invalid user admin from 185.217.0.127 port 1615 ssh2
Feb 08 16:33:10 ds11104 sshd[2981176]: pam_unix(sshd:auth): check pass; user unknown
Feb 08 16:33:12 ds11104 sshd[2981176]: Failed password for invalid user admin from 185.217.0.127 port 1615 ssh2
Feb 08 16:33:16 ds11104 sshd[2981176]: Disconnecting invalid user admin 185.217.0.127 port 1615: Change of username or service not allowed: (admin,ssh-connection) -> (,ssh-connection) [preauth]

As you can see – someone is repeatedly trying to poke my server. Although they are not getting in because this exploit has been removed, I wanted to add a layer of protection and that’s where fail2ban comes in.

Fail2ban basically allows 5 goes or however many you specify, for the nasties to get in, if they fail you can ban them for as long as you like, in my case 24 hours. Poor loves.

Ofcourse you can just change the port of ssh but you can see from this attack they are trying multiple ports so that’s not really going to help.

Installing and setting up

sudo su (or su if debian)

apt install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
nano /etc/fail2ban/jail.local


Edit: - 
I set bantime = 24h 

The rest leave as default - note not the bit at the start

Now enable the service

systemctl enable fail2ban
systemctl start fail2ban

Wait a bit and then

fail2ban-client status sshd

Here’s the results from mine after just 5 minutes:-

Status for the jail: sshd
|- Filter
| |- Currently failed: 3
| |- Total failed: 55
| - File list: /var/log/auth.log - Actions
|- Currently banned: 1
|- Total banned: 1
`- Banned IP list: 185.217.0.127

As you can see – our attacker was pretty quickly sent to hacker jail.

Another victory for truth and justice!

Update

Just to show you the level of ongoing attacks on my servers:-

Status for the jail: sshd
|- Filter
| |- Currently failed: 2
| |- Total failed: 1892
| - File list: /var/log/auth.log - Actions
|- Currently banned: 179
|- Total banned: 186
`- Banned IP list: 61.177.172.124 130.61.35.0 31.133.102.103 61.177.173.48 61.177.173.47 14.160.24.21 81.183.226.213 74.82.204.120 103.162.75.104 74.195.15.142 61.177.173.36 1.214.245.27 185.109.254.99 61.80.20.86 61.177.173.37 176.111.173.164 61.177.173.39 61.177.173.46 61.177.173.52 61.177.173.49 185.223.235.18 61.177.172.104 45.7.119.3 61.177.172.114 175.23.169.25 185.220.102.247 82.221.128.191 185.129.61.4 23.129.64.131 185.220.103.116 5.2.77.22 185.220.102.244 61.177.173.51 179.43.159.201 185.247.226.98 185.129.61.6 23.129.64.145 162.247.74.213 185.129.61.8 185.220.103.114 185.246.188.67 185.56.83.83 23.129.64.135 185.235.146.29 185.220.101.188 114.253.244.20 110.172.169.130 62.192.153.251 103.171.84.241 24.199.94.27 103.75.148.11 181.171.38.85 35.222.117.243 81.219.237.226 164.90.145.242 190.103.240.40 14.225.255.28 81.192.46.48 178.154.209.177 138.197.141.26 220.255.31.151 162.19.27.180 23.225.159.107 118.70.169.150 110.93.245.190 70.88.3.29 15.235.146.31 125.133.54.207 206.189.65.29 134.17.94.149 164.90.209.143 167.71.16.200 69.49.235.162 59.20.135.227 38.54.81.162 68.183.142.49 45.15.159.250 222.253.43.62 24.199.126.14 118.45.205.44 135.125.236.160 61.177.173.16 173.212.207.8 81.17.25.50 206.189.198.237 188.80.228.9 79.106.12.211 162.241.126.244 139.215.195.61 61.177.173.35 189.210.98.7 178.62.22.30 157.245.142.116 191.242.105.133 185.74.5.186 182.16.179.214 61.177.172.90 61.177.172.19 124.187.103.196 61.177.172.108 45.20.209.253 212.109.207.62 103.147.33.44 201.119.121.186 207.154.220.120 128.199.249.246 181.114.109.54 221.147.254.208 175.206.163.184 85.214.208.118 157.230.91.199 128.199.45.37 43.153.17.76 159.65.133.50 192.227.155.195 220.133.157.9 43.153.178.123 165.22.240.194 181.188.45.211 138.68.162.6 85.143.212.42 107.173.80.114 101.78.245.169 207.154.237.84 139.59.2.8 34.171.247.205 125.131.223.153 68.116.41.2 182.16.245.79 103.129.108.14 103.41.23.205 125.132.224.107 113.66.237.191 46.139.17.160 213.27.189.252 167.99.68.65 52.74.57.244 37.120.191.109 146.190.217.229 98.248.92.175 185.242.87.245 186.19.181.113 197.199.224.52 36.92.104.229 43.156.43.87 36.66.188.183 164.77.119.34 204.48.17.233 210.251.247.150 43.155.137.194 111.33.43.86 103.147.3.111 182.74.86.27 102.219.178.237 46.8.220.37 164.90.210.8 165.154.244.233 43.159.35.111 159.203.81.114 103.91.90.68 150.136.161.172 185.217.0.127 158.160.38.134 173.249.201.60 14.241.133.168 120.50.75.204 152.70.113.55 139.59.58.223 159.65.132.116 103.63.108.25 165.227.236.118 118.27.6.104 139.59.38.96 158.160.42.227 165.232.177.245 164.92.130.239 43.153.194.40 118.171.165.75 36.111.142.9

---

Filed under: Posts. - @ 8 February 2023 15:46