Break-In Attempts

Thousands of these 'break-in attempts' are sent automatically from (probably) stolen servers every day. I get tons of these, all of which are useless if you use public-key authentication.

tl;dr: There is no point in reporting them, and you should use public key authentication.

This will happen to you daily from numerous IP addresses.

You're not going to be able to keep up with the number of abuse reports you'll have to send out.

There is something worth taking a look at though to cut the attacking IP addresses off after so many tries: http://library.linode.com/security/basi … rd-attacks">http://library.linode.com/security/basics#sph_use-denyhosts-or-fail2ban-to-prevent-password-attacks

I recommend denyhosts, personally.

You can report them to the abuse email for the ip, in this case abuse@be.uu.net you can get that by doing whois ipaddress

However in all my years as an admin I've only ever had one response to an abuse email I've sent.

Is there a general way to identify the owner of an IP address? Some domains are kindof bogus like hn.ly.kd.adsl.

I'm thinking of something like looking up though BGB or IANA or something about who has the block of IP's.

Generally, the procedure is:

1) Look up the IP on http://www.iana.org/cgi-bin/whois to find out what RIR manages the IP

2) Look up the IP on the RIR's WHOIS page (IANA's whois gives you the address)

As an example, let me look up the IP of my linode, 97.107.142.x.

First, I enter the IP on the IANA whois. This tells me it's administered by ARIN, and that the whois for ARIN is http://whois.arin.net.

Next, I enter the IP on http://whois.arin.net, which tells me lots of info about this IP, such as that it's owned by Linode, the address and telephone number of Linode, their designated abuse contact, etc.

I'd find a new hobby - tracking down bots on the internet has a zero ROI (both in fun or profit).

Besides, if you don't take even the most minor of steps to secure your box so that you don't get hacked by script kiddies, most people (including myself) will have zero sympathy for you.

For looking up who is responsible for an IP, revip.info is a pretty good reference, too.

As others have stated…you just have to learn to ignore these things. Complete. Waste. Of. Time. (I do want to know what the one response to obs was, though!)

I will make the suggestion that you move SSH to a different port. It reduces the attempted logins from bots by a massive amount (essentially zero). It's like hiding your front door on the side of your house. You're still responsible for locking it, but at least it's not immediately evident from the street. Anyone else caught portscanning will be blocked by your CSF/LFD installation. And of course with LFD or fail2ban you're more protected from failed logins. To say nothing of using keys rather than passwords for SSH logins, which was noted by GLaDOSDan.

Thank you, I had already secured the box. How to secure the box wasn't really my question. In any case if I hadn't my machine would have been compromised days ago. I have had 2800 attempted logins in the last week. 2300 today :).

I really don't like it that someone can constantly attempt to break into other machines and nobody will do anything about it. Though I imagine Jurisdiction and Language put up some pretty big barriers. Most of the attacks so far have come from Russia (surprise :) ), China (surprise :) ), Vietman and Indonesia. Even if the operator was willing to do something I doubt we would be able to communicate.

I'm hoping for a bit of luck with the 2300 attempts today. They almost all came from a site in Montreal, and maybe I will have a bit of luck as I also Hail from Canada.

PS: I have found just invoking "whois [ip]" from Linux gives the best answers on who is responsible. Most operators will an abuse email address.

Now I assume it is NOT futile to contact Linode about abuse …

They have abuse contacts …

RAbuseHandle: LAS12-ARIN

RAbuseName: Linode Abuse Support

RAbusePhone: +1-609-593-7103

RAbuseEmail: abuse@linode.com

RAbuseRef: http://whois.arin.net/rest/poc/LAS12-ARIN

You should get a mask and a cape - then you could be the superhero fighting botnets on the wild wild Internet.

Never fear!!!!!!! Bitboy is here!!!!!!!

Whooooosh, Zap!, Bammo!

@mikefletcher:

Thank you, I had already secured the box. How to secure the box wasn't really my question. In any case if I hadn't my machine would have been compromised days ago. I have had 2800 attempted logins in the last week. 2300 today :).

Well, to be fair, if you took my advice and changed the port that number would be zero. Just sayin'. I know it wasn't your question, but I considered it helpful advice, since I don't consider reporting eastern european script kiddies to be of any particular use. I suspect you will eventually be frustrated by a lack of interest on the part of people who don't care about what goes on in their own networks, let alone yours.

@haus:

Well, to be fair, if you took my advice and changed the port that number would be zero.

I've changed my SSH port number to 1402 and still have 10-20 break-in attempts per hour. No idea how they found out which port it is.

These break-in attempts are pretty useless because I only use public-key authentication. Still annoying, though.

@vonskippy:

You should get a mask and a cape - then you could be the superhero fighting botnets on the wild wild Internet.

Never fear!!!!!!! Bitboy is here!!!!!!!

Whooooosh, Zap!, Bammo! Holy address lookup! Is that IPv6, Bitboy??

@Stan 2.0:

@haus:

Well, to be fair, if you took my advice and changed the port that number would be zero.

I've changed my SSH port number to 1402 and still have 10-20 break-in attempts per hour. No idea how they found out which port it is.

These break-in attempts are pretty useless because I only use public-key authentication. Still annoying, though.

Port scans.

I lock the ssh port down to my ip address….of course if you don't have a static IP you're screwed.

@obs:

… of course if you don't have a static IP you're screwed.

Exactly. My IP changes way too often to rely on that.

Another option then is to enable iptables rate limiting on your ssh port, it will at least prevent log flooding.

@Stan 2.0:

@haus:

Well, to be fair, if you took my advice and changed the port that number would be zero.

I've changed my SSH port number to 1402 and still have 10-20 break-in attempts per hour. No idea how they found out which port it is.

These break-in attempts are pretty useless because I only use public-key authentication. Still annoying, though.

Raise it above 10000 and use CSF to stop portscans. You need to choose a port that isn't already commonly used by some service, or it will already be on the bot lists. They didn't find your port, it was dumb luck.

In my setup, I have SSH listening on 22 and another port >10000. the >10000 port is publicly accessible and 22 is restricted to my ISP's subnets since I have a dynamic IP. Listening on 22 gives me the convenience to not always have to specify the port and >10000 allows me to login if I'm not at home.

This is enough to get 0 break-in attempts on SSH in the 1+ year I've had this setup. Of course, I also have all the typical measures, no root logins, public key authentication only, etc.

Locking it down to your isp's subnet is a good idea I never thought of that :o has a static ip

I've always wanted to do that, but every couple of years Comcast does something crazy and I get a new IP address with a completely different IP, in a block I never knew they had. So if you can do it, great, but be careful to have a backup plan in case you get locked out.

@haus:

I've always wanted to do that, but every couple of years Comcast does something crazy and I get a new IP address with a completely different IP, in a block I never knew they had. So if you can do it, great, but be careful to have a backup plan in case you get locked out.

Use LISH if you ever get locked out, if it only happens ever couple of years you could get away with it.

@obs:

Use LISH if you ever get locked out, if it only happens ever couple of years you could get away with it.
Annoyingly, my local cable provider recently changed my home address during a maintenance window, after it having essentially been static for, I think, almost 10 years. I always knew it could theoretically happen, but it had been so long I had certainly taken it for granted.

My Linodes generally have very limited general access, but complete access for my home address which was an easy configuration to block all the various random attempts while not getting in my way. Of course I had the benefit of having such a static-like address.

Anyway, LISH is exactly how I handled it. A quick LISH connection to each node, adjust to the new address, and keep going.

– David