Article 5C21X Somebody trying to break in to my new VPS? Cause for concern?

Somebody trying to break in to my new VPS? Cause for concern?

by
walterbyrd
from LinuxQuestions.org on (#5C21X)
There is nothing on my site yet. I don't even have a web server working.

While trying to get my web server working, I did a Code:journal -xe. I was surprised to find this (see below). I did an nmap on myself, the ports I have open are ssh and ftp. I had ssh assigned to a random port number - not 22. I took a look at my /etc/password file, it seems to be okay.

I also did a Code:# last -20 looks like I am the only one who has ever logged in.

Anything else I should do?

All these attempted logins seemed to take place within 11 seconds. They are still trying to login. Not sure what to do about it. Maybe I should shut down ssh for a while, and bring it back up with an at command?

Code:Dec 24 19:22:42 www sshd[293795]: pam_unix(sshd:auth): check pass; user unknown
Dec 24 19:22:42 www sshd[293795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.91.126.92
Dec 24 19:22:42 www sshd[293797]: Invalid user deployer from 158.101.12.235 port 33020
Dec 24 19:22:42 www sshd[293797]: pam_unix(sshd:auth): check pass; user unknown
Dec 24 19:22:42 www sshd[293797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.101.12.235
Dec 24 19:22:44 www sshd[293795]: Failed password for invalid user halley from 125.91.126.92 port 57996 ssh2
Dec 24 19:22:44 www sshd[293795]: Received disconnect from 125.91.126.92 port 57996:11: Bye Bye [preauth]
Dec 24 19:22:44 www sshd[293795]: Disconnected from invalid user halley 125.91.126.92 port 57996 [preauth]
Dec 24 19:22:44 www sshd[293797]: Failed password for invalid user deployer from 158.101.12.235 port 33020 ssh2
Dec 24 19:22:45 www sshd[293797]: Received disconnect from 158.101.12.235 port 33020:11: Bye Bye [preauth]
Dec 24 19:22:45 www sshd[293797]: Disconnected from invalid user deployer 158.101.12.235 port 33020 [preauth]
Dec 24 19:22:48 www sshd[293799]: Invalid user shirley from 106.51.85.16 port 59938
Dec 24 19:22:48 www sshd[293799]: pam_unix(sshd:auth): check pass; user unknown
Dec 24 19:22:48 www sshd[293799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.85.16
Dec 24 19:22:49 www sshd[293801]: Invalid user access from 81.68.216.148 port 48956
Dec 24 19:22:49 www sshd[293801]: pam_unix(sshd:auth): check pass; user unknown
Dec 24 19:22:49 www sshd[293801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.68.216.148
Dec 24 19:22:50 www sshd[293799]: Failed password for invalid user shirley from 106.51.85.16 port 59938 ssh2
Dec 24 19:22:50 www sshd[293799]: Received disconnect from 106.51.85.16 port 59938:11: Bye Bye [preauth]
Dec 24 19:22:50 www sshd[293799]: Disconnected from invalid user shirley 106.51.85.16 port 59938 [preauth]
Dec 24 19:22:51 www sshd[293801]: Failed password for invalid user access from 81.68.216.148 port 48956 ssh2
Dec 24 19:22:53 www sshd[293801]: Received disconnect from 81.68.216.148 port 48956:11: Bye Bye [preauth]
Dec 24 19:22:53 www sshd[293801]: Disconnected from invalid user access 81.68.216.148 port 48956 [preauth]latest?d=yIl2AUoC8zA latest?i=iFKbTj6BW2E:09u1hVAi5GQ:F7zBnMy latest?i=iFKbTj6BW2E:09u1hVAi5GQ:V_sGLiP latest?d=qj6IDK7rITs latest?i=iFKbTj6BW2E:09u1hVAi5GQ:gIN9vFwiFKbTj6BW2E
External Content
Source RSS or Atom Feed
Feed Location https://feeds.feedburner.com/linuxquestions/latest
Feed Title LinuxQuestions.org
Feed Link https://www.linuxquestions.org/questions/
Reply 0 comments