Am I under attack?

[lwizard]

Mar 25 21:53:57 dropbear[1210]: Child connection from 115.29.190.221:35362
Mar 25 21:53:59 dropbear[1210]: Login attempt for nonexistent user from 115.29.190.221:35362
Mar 25 21:54:00 dropbear[1210]: Exit before auth: Exited normally

This repeats all day long..

I have disabled SSH from WAN and SSH port forwarding.

Now it seems that there is no more activity.

 

[Pericynthion]

I think 'attack' is a strong word, but you're certainly being probed for accessibility ;-)

http://myip.ms/view/ip_addresses/1931329024/115.29.190.0_115.29.190.255

There are a couple of people on the forums reporting IP addresses originating in China trying to establish VPN connections (including myself), and in your case SSH.

I presume they are port-scanning entire address ranges and just looking for weaknesses.

 

[vdemarco]

I think 'attack' is a strong word, but you're certainly being probed for accessibility ;-)

http://myip.ms/view/ip_addresses/1931329024/115.29.190.0_115.29.190.255

There are a couple of people on the forums reporting IP addresses originating in China trying to establish VPN connections (including myself), and in your case SSH.

I presume they are port-scanning entire address ranges and just looking for weaknesses.

I have ssh open on my machine (not the router) and it gets probed every single day.

If you have ssh open, you need to take measures. I have blacklisted china and a bunch of other countries on the router.

And the machine has a very small white list of ip addresses that can connect.
(i can get in from work, and from my mother in laws house)

So far nobody has been able to get in.

(knock on wood)

 

[RMerlin]

Enabling Brute Force Protection will also make it very unlikely someone will be able to brute force your login, by throttling their connection attempts.

 

[Nerre]

I have disabled SSH from WAN and SSH port forwarding.

If ssh from WAN is diabled, those log entries are strange....

 

[lwizard]

In fact it was enabled. Now I have disabled WAN ssh access and they are quitted.
Yes, I have also enabled brute force protection.

I can't do a whitelist because my IPs outdoor are various.

I have web interface enabled on WAN (I need it to WOL from WAN), so I will enable ssh access from WAN only when needed.

Thanks!

 

[Nerre]

As long as you have a good enough password you shouldn't worry.

 

[connorm]

Mar 25 21:53:57 dropbear[1210]: Child connection from 115.29.190.221:35362
Mar 25 21:53:59 dropbear[1210]: Login attempt for nonexistent user from 115.29.190.221:35362
Mar 25 21:54:00 dropbear[1210]: Exit before auth: Exited normally

This repeats all day long..

I have disabled SSH from WAN and SSH port forwarding.

Now it seems that there is no more activity.

i have seen this happen before, mainly when my tenants run torrents.

used to pop up like crazy in my logs. but i never had any problems.

 

[elpibe10]

This is one of the main reasons that prompted me to upgrade away from consumer routers.

With an Ubiquiti EdgeRouter or MikroTik RouterBOARD, you can simply create a firewall rule to drop all packets from your pre-defined Blacklisted IP table and that person won't even have a chance to even try to login to your VPN server again.

Best part is all these can be done on the GUI. No cryptic scripts or SSH connections to mess around with unlike AsusWRT or DD-WRT.

 

[Nerre]

That's usually not very useful, because those log on attempts almost never originates from the same IP address.

 

[Kris404]

Mar 25 21:53:57 dropbear[1210]: Child connection from 115.29.190.221:35362
Mar 25 21:53:59 dropbear[1210]: Login attempt for nonexistent user from 115.29.190.221:35362
Mar 25 21:54:00 dropbear[1210]: Exit before auth: Exited normally

This repeats all day long..

I have disabled SSH from WAN and SSH port forwarding.

Now it seems that there is no more activity.

I get those SSH login attempts too for my Synology NAS (for SCP).

I ended up choosing TCP/Port 22222 instead of 22. It helps that the NAS also has an auto-block feature for failed login attempts.

 

[elpibe10]

That's usually not very useful, because those log on attempts almost never originates from the same IP address.

Not supposed to block just 1 IP address.

I'll usually block the entire chunk belonging to the ISP and some can go as big as /8

 

[jim769]

Delete.....