Ygtjki

When I make the command journalctl -xe on my VPS (Debian 9) host by OVH, I see several attempts to connect, is this normal?

Here is a small part of the logs:

-- Logs begin at Mon 2019-04-08 22:51:43 CEST, end at Tue 2019-04-09 09:31:32 CE
ST. --
Apr 09 08:01:49 vps668970 sshd[4559]: Disconnected from 173.249.50.217 port 4333
8 [preauth]
Apr 09 08:02:21 vps668970 sshd[4561]: pam_unix(sshd:auth): authenticatio
n failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.249.50.217 user=root

Apr 09 08:02:23 vps668970 sshd[4561]: Failed password for root from 173.249.50.2
17 port 34630 ssh2
Apr 09 08:02:23 vps668970 sshd[4561]: Received disconnect from 173.249.50.217 po
rt 34630:11: Normal Shutdown, Thank you for playing [preauth]
Apr 09 08:02:23 vps668970 sshd[4561]: Disconnected from 173.249.50.217 port 3463
0 [preauth]
Apr 09 08:02:54 vps668970 sshd[4563]: pam_unix(sshd:auth): authenticatio
n failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.249.50.217 user=root

Apr 09 08:02:56 vps668970 sshd[4563]: Failed password for root from 173.249.50.2
17 port 54154 ssh2
Apr 09 08:02:56 vps668970 sshd[4563]: Received disconnect from 173.249.50.217 po
rt 54154:11: Normal Shutdown, Thank you for playing [preauth]
Apr 09 08:02:56 vps668970 sshd[4563]: Disconnected from 173.249.50.217 port 5415
4 [preauth]
Apr 09 08:03:23 vps668970 kernel: [UFW BLOCK] IN=ens3 OUT= MAC=fa:16:3e:

Yes, this is normal.

Read this interesting symantec article on "Analyzing Malicious SSH Login Attempts".

Here is the top 20 of failed login account names and number of tries for my server since April, 1st:

 2919 root
 194 admin
 122 test
 83 zabbix
 67 user
 66 ftpuser
 65 postgres
 60 mysql
 58 nagios
 49 ubuntu
 44 www-data
 43 pi
 42 support
 42 oracle
 39 jboss
 36 guest
 34 usuario
 33 tomcat
 32 dell
 30 www

• 9872 total attempts with 2182 different account names.


• 0.8 attempts per minute.

root ssh login is disabled, the rest of all account names does not exist or has /usr/sbin/nologin or /bin/false as shell. So nothing to worry about.

I have fail2ban installed to reduce the possible attempts per time, but as the attempts come from botnets with lots of IP addresses and fail2ban works on IP addresses it's not too effective.

Next possible option to reduce the number of attempts would be to change the ssh port.

Command to gather this information:

grep -ho 'Failed password for .*' /var/log/auth.log,.1 
 | awk 'if ($4=="invalid") print $6 else print $4 ' 
 | sort | uniq -c | sort -nr | head -n20