Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #219402 > unrolled thread
| Started by | steve <dlist@bluewin.ch> |
|---|---|
| First post | 2020-02-24 21:40 +0100 |
| Last post | 2020-02-29 10:00 +0100 |
| Articles | 8 — 7 participants |
Back to article view | Back to linux.debian.user
Connection closed by [IP] port [port] [preauth] steve <dlist@bluewin.ch> - 2020-02-24 21:40 +0100
Re: Connection closed by [IP] port [port] [preauth] Dan Ritter <dsr@randomstring.org> - 2020-02-24 22:00 +0100
Re: Connection closed by [IP] port [port] [preauth] steve <dlist@bluewin.ch> - 2020-02-26 07:10 +0100
Re: Connection closed by [IP] port [port] [preauth] john doe <johndoe65534@mail.com> - 2020-02-24 22:10 +0100
Re: Connection closed by [IP] port [port] [preauth] Tixy <tixy@yxit.co.uk> - 2020-02-25 07:50 +0100
Re: Connection closed by [IP] port [port] [preauth] deloptes <deloptes@gmail.com> - 2020-02-26 08:00 +0100
Re: Connection closed by [IP] port [port] [preauth] Klaus Singvogel <deb-user-ml@singvogel.net> - 2020-02-26 08:50 +0100
Re: Connection closed by [IP] port [port] [preauth] Didar Hossain <didar@purlo.in> - 2020-02-29 10:00 +0100
| From | steve <dlist@bluewin.ch> |
|---|---|
| Date | 2020-02-24 21:40 +0100 |
| Subject | Connection closed by [IP] port [port] [preauth] |
| Message-ID | <zDsGe-7jU-5@gated-at.bofh.it> |
Hi there, Since February 11th at 00:25:09, I am getting the following every 12 secondes: Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 port 54422 [preauth] And when I say every 12 seconds, it is really every 12 seconds, and this is now going on for more than 13 days, without any interruption. At the beginning, I thought that this was just standards nmap scans or something similar and so didn't bother taking any action. But now I'm asking myself who (in China) would be so stupid to continue this scanning. What should I do? Send an email to the abuse contact? Ignore it and wait that it's over? It doesn't seem naughty but it's getting irritating. Thanks S
[toc] | [next] | [standalone]
| From | Dan Ritter <dsr@randomstring.org> |
|---|---|
| Date | 2020-02-24 22:00 +0100 |
| Message-ID | <zDsZA-7qV-9@gated-at.bofh.it> |
| In reply to | #219402 |
steve wrote: > Hi there, > > Since February 11th at 00:25:09, I am getting the following every 12 > secondes: > > Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 port 54422 [preauth] > > And when I say every 12 seconds, it is really every 12 seconds, and this > is now going on for more than 13 days, without any interruption. At the > beginning, I thought that this was just standards nmap scans or > something similar and so didn't bother taking any action. But now I'm > asking myself who (in China) would be so stupid to continue this > scanning. > > What should I do? Send an email to the abuse contact? Ignore it and wait > that it's over? It doesn't seem naughty but it's getting irritating. sudo apt install iptables-persistent sudo iptables -A INPUT -s 118.126.105.120 -j DROP sudo netfilter-persistent save If you want rules inserted automatically and removed after a time, install fail2ban. -dsr-
[toc] | [prev] | [next] | [standalone]
| From | steve <dlist@bluewin.ch> |
|---|---|
| Date | 2020-02-26 07:10 +0100 |
| Message-ID | <zDY3n-2Cg-1@gated-at.bofh.it> |
| In reply to | #219403 |
Le 24-02-2020, à 15:51:53 -0500, Dan Ritter a écrit : >steve wrote: >> Hi there, >> >> Since February 11th at 00:25:09, I am getting the following every 12 >> secondes: >> >> Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 port 54422 [preauth] >> >> And when I say every 12 seconds, it is really every 12 seconds, and this >> is now going on for more than 13 days, without any interruption. At the >> beginning, I thought that this was just standards nmap scans or >> something similar and so didn't bother taking any action. But now I'm >> asking myself who (in China) would be so stupid to continue this >> scanning. >> >> What should I do? Send an email to the abuse contact? Ignore it and wait >> that it's over? It doesn't seem naughty but it's getting irritating. > >sudo apt install iptables-persistent >sudo iptables -A INPUT -s 118.126.105.120 -j DROP >sudo netfilter-persistent save Clean logs, thanks :) Funny, right after issuing these commands, new IP started scanning my system. Re-issued the commands and the problem was solved. Thanks a lot. S
[toc] | [prev] | [next] | [standalone]
| From | john doe <johndoe65534@mail.com> |
|---|---|
| Date | 2020-02-24 22:10 +0100 |
| Message-ID | <zDt9g-7JC-5@gated-at.bofh.it> |
| In reply to | #219402 |
On 2/24/2020 9:38 PM, steve wrote: > Hi there, > > Since February 11th at 00:25:09, I am getting the following every 12 > secondes: > > Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 > port 54422 [preauth] > > And when I say every 12 seconds, it is really every 12 seconds, and this > is now going on for more than 13 days, without any interruption. At the > beginning, I thought that this was just standards nmap scans or > something similar and so didn't bother taking any action. But now I'm > asking myself who (in China) would be so stupid to continue this > scanning. > > What should I do? Send an email to the abuse contact? Ignore it and wait > that it's over? It doesn't seem naughty but it's getting irritating. > Find a way to block/ban this address, fail2ban, firewall and to some extend sshd_config. -- John Doe
[toc] | [prev] | [next] | [standalone]
| From | Tixy <tixy@yxit.co.uk> |
|---|---|
| Date | 2020-02-25 07:50 +0100 |
| Message-ID | <zDCcx-5N8-3@gated-at.bofh.it> |
| In reply to | #219402 |
On Mon, 2020-02-24 at 21:38 +0100, steve wrote: > Hi there, > > Since February 11th at 00:25:09, I am getting the following every 12 > secondes: > > Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 port 54422 [preauth] I'm getting that too. > And when I say every 12 seconds, it is really every 12 seconds, and this > is now going on for more than 13 days, without any interruption. At the > beginning, I thought that this was just standards nmap scans or > something similar and so didn't bother taking any action. But now I'm > asking myself who (in China) would be so stupid to continue this > scanning. The bot is possibly try to trigger some vulnerability, which we can expect is a known one and fixed in Debian. > What should I do? Send an email to the abuse contact? Ignore it and wait > that it's over? It doesn't seem naughty but it's getting irritating. You've already had the same suggestions I'd give. I run fail2ban on all internet facing systems, which will block IP addresses which are repeatedly trying and failing things like password logins to sshd. Unfortunately, simple connection drops like these aren't covered by the built-in rules. There may be ways of adding custom rules, but I've just taken to manually adding IP addresses to a blacklist with iptables. (To avoid their irritation in the logs rather than fear that the bots will be able to do anything nasty.) -- Tixy
[toc] | [prev] | [next] | [standalone]
| From | deloptes <deloptes@gmail.com> |
|---|---|
| Date | 2020-02-26 08:00 +0100 |
| Message-ID | <zDYPL-2Sg-5@gated-at.bofh.it> |
| In reply to | #219412 |
Tixy wrote: >> Since February 11th at 00:25:09, I am getting the following every 12 >> secondes: >> >> Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 >> port 54422 [preauth] > > I'm getting that too. +1 :( and I am not using standard port 22, so they scanned all 30000 ports and found out what is open (well filtered) and now are trying to do brute force on SSH. Others are trying to exploit apache/php & Co.
[toc] | [prev] | [next] | [standalone]
| From | Klaus Singvogel <deb-user-ml@singvogel.net> |
|---|---|
| Date | 2020-02-26 08:50 +0100 |
| Message-ID | <zDZCa-3n5-5@gated-at.bofh.it> |
| In reply to | #219453 |
deloptes wrote: > +1 :( and I am not using standard port 22, so they scanned all 30000 ports > and found out what is open (well filtered) and now are trying to do brute > force on SSH. Others are trying to exploit apache/php & Co. I'm using portsentry against this: https://packages.debian.org/buster/portsentry Let it sniff on some unused ports, like 445, 69, 8181, 5353, or 22. :-) https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers But beware to have a whitelisted IP address active. I locked myslef out, after switching to a different computer, like fresh a installed Linux. :-) Regards, Klaus. -- Klaus Singvogel GnuPG-Key-ID: 1024R/5068792D 1994-06-27
[toc] | [prev] | [next] | [standalone]
| From | Didar Hossain <didar@purlo.in> |
|---|---|
| Date | 2020-02-29 10:00 +0100 |
| Message-ID | <zF68x-5O8-3@gated-at.bofh.it> |
| In reply to | #219455 |
On Wed, Feb 26, 2020 at 08:49:28AM +0100, Klaus Singvogel wrote: > deloptes wrote: > > +1 :( and I am not using standard port 22, so they scanned all 30000 ports > > and found out what is open (well filtered) and now are trying to do brute > > force on SSH. Others are trying to exploit apache/php & Co. > > I'm using portsentry against this: > https://packages.debian.org/buster/portsentry > > Let it sniff on some unused ports, like 445, 69, 8181, 5353, or 22. :-) > > https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers > > But beware to have a whitelisted IP address active. I locked myslef out, > after switching to a different computer, like fresh a installed Linux. :-) "fwknop" is another tool to consider if you don't like getting scanned. Regards, Didar > > Regards, > Klaus. > -- > Klaus Singvogel > GnuPG-Key-ID: 1024R/5068792D 1994-06-27 > -- Basic Definitions of Science: If it's green or wiggles, it's biology. If it stinks, it's chemistry. If it doesn't work, it's physics.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web