I was looking into my log files on my server and I found the following lines in: /var/log/.auth.log.1:
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruse r= rhost=218.87.109.156 user=root
Failed password for root from 218.87.109.156 port 7612 ssh2
message repeated 5 times: [ Failed password for root from 218.87.109.156 port 7 612 ssh2]
error: maximum authentication attempts exceeded for root from 218.87.109.156 po rt 7612 ssh2 [preauth]
Disconnecting: Too many authentication failures [preauth]
PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost= 218.87.109.156 user=root
PAM service(sshd) ignoring max retries; 6 > 3
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruse r= rhost=218.87.109.156 user=root
Failed password for root from 218.87.109.156 port 50092 ssh2
message repeated 5 times: [ Failed password for root from 218.87.109.156 port 5 0092 ssh2]
Failed password for invalid user service from 188.187.119.158 port 52722 ssh2
pam_unix(sshd:auth): check pass; user unknown
Failed password for root from 113.195.145.79 port 6500 ssh2
Received disconnect from 121.18.238.39 port 58070:11: [preauth]
Failed password for root from 121.18.238.119 port 57538 ssh2
Failed password for root from 121.18.238.39 port 57268 ssh2
Failed password for root from 121.18.238.106 port 34360 ssh2
Disconnected from 92.222.216.31 port 58960 [preauth]
Invalid user truman from 92.222.216.31
Received disconnect from 92.222.216.31 port 33922:11: Normal Shutdown, Thank you for playing [preauth]
input_userauth_request: invalid user truman [preauth]
And it keeps going on like this for thousands of lines!
And also somewhere I have:
Nov 30 13:17:01 Aran CRON[6038]: pam_unix(cron:session): session opened for user root by (uid=0)
What does CRON mean in here? so can somebody please explain to me what are these logs? Am I in danger? what should I do to get myself more secure?
All those attempted logins are for the root user so it looks like just basic brute-force attempts via SSH.
It's entirely normal for a public-facing server to have lots of SSH brute-force attempts a day. It's a fact of life. You can start reporting them to the ISP who owns the IP address, but it's whack-a-mole and you're not going to make a big difference. They're using compromised computers all over the internet and/or hosting accounts they signed up for under false details.
What would make a difference is if everyone decided to disable root login over SSH, and/or require key-based login for root (or for everyone). As long as you've done one of these the brute-force attempts will basically be ineffective. But because enough people still leave plain root login enabled, and have a guessable password on it, these attacks continue.
Another thing that some people recommend is switching your SSH daemon to a non-standard port number. This doesn't really give a significant security benefit but it will cut down on the number of attempts reaching your logfiles.
As for your second question, this is just Cron running, which is the program that runs scheduled tasks. All systems have a bunch of scheduled tasks configured by default by the system. Since cron can run different tasks as different users it uses pam_unix to handle starting a user session, even when root, so that's why it appears in that log.
This answer doesn't really answer who is trying to log into your host, but it can give you an idea of where the person is coming from. Also help in preventing hackers from even getting to your host.
If you're going to use passwords for logging in through ssh, you should take some precautions as to people trying to hack into your system. For my personal use I like to use
fail2banand then I wrote my own script that usesiptablesandipset. The latter part I use for complete blocking of country IPs from coming in to my host on port 22. I have also installedgeoiplookupas a way to see where the IP is coming from to decide if I want to block the country or not. The script I have below obtains the sets of IPs fromipdeny.com. It has drastically reduced the amount of attempts on my host since I leave port 22 open most of the time.Installing
fail2ban:Usually with
fail2banthe default settings are OK. If you want to change them make sure to copy/etc/fail2ban/jail.confas/etc/fail2ban/jail.localand make the modifications to thejail.localfile you have created. You can also see failed attempts in the/var/log/fail2ban.logfile.Installing
geoiplookup:Then you can see where the IP addresses are coming from.
The country blocking script that I created.
A required application for the country block is
ipset. This application allowsiptablesto use a block of IPs instead of showing every individual IP address when you check the status ofiptables.I am certain that there is a lot that can be cleaned up. I put mine in my home folder in a subfolder of scripts and called it
country_block.bsh. Since the script makes changes toiptablesit has to be called fromsudo. I did add the check into the script. I have made some recent changes to the script to REJECT the packets instead of dropping so the connection is instantly disconnected.Make sure to make the script executable (
chmod +x country_block.bsh). You can then create acustom.zonein the same folder as thecountry_block.bshfile with just IPs that might be trying over and over again to hack your system. Add them with a/32at the end of the IP address like256.99.265.106/32. After you add your own custom IPs, you can reload them in simply by running:Be careful not to block your own country or your own public IP.
Also be careful not to block any other ports that are not open. If you block port 80, there is a chance that if you visit a website from that country it will not load because it cannot return to your system on port 80.
Then I created another script in my home folder called
cb_update.bshthat contains all the countries I want to block:If you want to block all countries except for your own change the above line to the following and make sure to add your country into the
" "at the end of the line to remove your country from the list:Then I added the following lines to my
/etc/crontabfile. It covers every time my system reboots and it updates the list at 01:05 in the morning.If you run the script by itself, it will give you the country codes:
You can then check at anytime the hits that might be happening to your system.
Hope this helps!
Unless you have Nation State level control/access over all computers/networks available to your server finding the person behind the login attempts is functionally impossible. You can however work to harden your server. see, How to harden an SSH server?, and What Can Be Done To Secure Ubuntu Server?
The IP address
218.87.109.156is not in DNS, and tracepath (from Ottawa, Canada) shows:Doing
dig -xandtracepathon the rest of the IPs is left as an exercise.I'd guess that you're under attack. If you're not behind a firewall (and why not?), investigate the
fail2banpackage, or, if you're not using it, stop runningsshd.CRONis the system's job scheduler, on my system, I see hundreds of these a day.You can also change the default port to another non-standard port if you don't necessary need port 22 on the internet.
Even if you use fail2ban you will still have a number of failed attempts / day. I never leave the default port open to the internet. For SSH at least. Lots of bots these days bruteforcing.
You can do this by editing the file
/etc/ssh/sshd_configThere must be a line similar to:#Port 22Remove the # in front and change 22 to your desired port value ( 1 to 65535 )Example:
Port 1337Then you can test the validity of the config ( make sure there's no extra characters, or it might not start - this is useful when you're restarting sshd remote, it might not restart properly and you need access via other routes ) Test using the command :
/usr/sbin/sshd -tRemember: no output generally means no error.
And then you need to restart sshd service:
sudo systemctl restart sshdor
sudo service sshd restartor
sudo killall -HUP sshdThen you can ssh into your server using the custom port. From other terminal you can use:
ssh <serverHostname> -p <port>.And for lazy people like me, if you don't want to specify that port all the time, you can change the default port in the same manner in file
/etc/ssh/ssh_config( this is the file for the ssh command ) so you don't have to add the-p <port>option all the time.I second what most others have said, but in my experience, most SSH brute force attacks these days are distributed attacks (coming from hundreds or thousands of different IP addresses with few or no repeats), so packages like
fail2banare less useful than they used to be.Basic precautions would be:
ufwto drop connections to all but allowed ports/etc/ssh/sshd_configmake sure that the root login line saysPermitRootLogin no)AllowUsers myuser)There are a bunch of other things you can do, just look up articles on SSH hardening. Essentially, if you're using a 2048- or 4096-bit key, nobody will be able to brute-force it.
The CRON entries, as already pointed out, are created automatically every time the system starts a scheduled job (whenever CRON runs).
You might also look into packages such as
logwatchto get a daily digest of what your logs are doing and respond more quickly should something happen that needs your attention. It's saved my bacon more than once.