[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-relays] Relay failed logins

Hi Olaf,

SSH brute force attacks are commonplace on any internet facing server with port 22 open. You have a number of countermeasure options:

1) install fail2ban which will block anyone who fails a login 3 times
2) move SSH to a non standard port (preferably >1000)
3) reconfigure SSH to only allow login with keys instead of passwords - generate and successfully test login with a key first before you set this option
4) change the firewall to only allow logins from a specified IP address (yours if you have a static IP)

I recommend if you can that you implement all of these measures as they will improve your security and stop the attacks filling up your logfiles.

S

On February 24, 2018 7:36:16 PM UTC, Olaf Grimm <jeep665@xxxxxxxxx> wrote:
Dear guys,


I am now on my server with SSH and get the message during login:

...

Last failed login: Sat Feb 24 14:22:47 EST 2018 from 5.188.10.179 on
ssh:notty
There were 1343 failed login attempts since the last successful login.

...


This simple relay (no exit) is online since less days. Location Moldavia
/ Trabia Network; VPS

Is this amount of attacks regular? In the past i had a log file of 12MB
on an other server - all failed logins.

It is not a problem. It is only for my feeling "Ok, That's right!".

Nickname node49c


Olaf



tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

--
Spiros Andreou
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays