Linode Forum
https://forum.linode.com/

ssh attempts on non-ssh port
https://forum.linode.com/viewtopic.php?f=19&t=10927		 Page 1 of 1
Author:  Dweeber [ Sat Mar 29, 2014 5:05 pm ]
Post subject:  ssh attempts on non-ssh port
I am seeing Fail2Ban blocks for ssh connection attempts on a ports that I don't have configured to allow ssh connections from.

Is this just seeing the attempts even though there is no way to actually use those ports?

Example:

Code:
Mar 28 23:18:30 ulterius sshd[18292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.228.245.151  user=root
Mar 28 23:18:31 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:33 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:35 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:37 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:39 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2


IPtables are not setup to allow a connection to SSH on port 3355. So any attempt would be denied. but the first line seems to have me wondering if it is still getting though?


Code:
#  Allow SSH connections
#  The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 2222 -j ACCEPT


is the section in my IPtables related to ssh.
Author:  Nuvini [ Sat Mar 29, 2014 5:24 pm ]
Post subject:  Re: ssh attempts on non-ssh port
your iptables accepts incoming connections TO port 2222. Port 3355 in the logs above is the source port. Not the port that IP is connecting to, but the port that IP is connection FROM. This is generally a random high port, afaik.
Page 1 of 1 All times are UTC-04:00
Powered by phpBB® Forum Software © phpBB Group
http://www.phpbb.com/