I'm new here so please bear with me. And thanks for the opportunity. This is an awesome resource.
For the past few days, my ssh server (it's a small convenience I run just so that I can access my system at home) has been seeing a steady stream of failed logins. My IDS/IPS catches a few stray login attempts from time to time, but this has been days of failed attempts one after another from 1 to 5 minutes apart. I figured it was a dedicated scriptkiddie but but when I looked, the origin IP address for each attempt is different. Appears mostly to originate from Brazil, but it's all over the map.
Here is a short excerpt:
Feb 6 23:09:59 shuttle sshd[2946]: Received disconnect from 201.22.86.66: 11: Bye Bye [preauth]
Feb 6 23:10:01 shuttle sshd[2996]: Invalid user tester from 128.199.230.117
Feb 6 23:10:01 shuttle sshd[2996]: input_userauth_request: invalid user tester [preauth]
Feb 6 23:10:02 shuttle sshd[2996]: pam_tcb(sshd:auth): Authentication failed for UNKNOWN USER from (uid=0)
Feb 6 23:10:02 shuttle sshd[2998]: Invalid user admin from 117.48.224.130
Feb 6 23:10:02 shuttle sshd[2998]: input_userauth_request: invalid user admin [preauth]
Feb 6 23:10:02 shuttle sshd[2998]: pam_tcb(sshd:auth): Authentication failed for UNKNOWN USER from (uid=0)
Feb 6 23:10:03 shuttle sshd[2996]: Failed password for invalid user tester from 128.199.230.117 port 60968 ssh2
Feb 6 23:10:03 shuttle sshd[2996]: Received disconnect from 128.199.230.117: 11: Bye Bye [preauth]
Feb 6 23:10:04 shuttle sshd[2998]: Failed password for invalid user admin from 117.48.224.130 port 47743 ssh2
Feb 6 23:10:04 shuttle sshd[2998]: Received disconnect from 117.48.224.130: 11: Bye Bye [preauth]
Feb 6 23:10:06 shuttle sshd[3011]: Invalid user upload from 94.76.179.235
Feb 6 23:10:06 shuttle sshd[3011]: input_userauth_request: invalid user upload [preauth]
Feb 6 23:10:06 shuttle sshd[3011]: pam_tcb(sshd:auth): Authentication failed for UNKNOWN USER from (uid=0)
Feb 6 23:10:09 shuttle sshd[3011]: Failed password for invalid user upload from 94.76.179.235 port 49348 ssh2
Feb 6 23:10:09 shuttle sshd[3011]: Received disconnect from 94.76.179.235: 11: Bye Bye [preauth]
Feb 6 23:10:14 shuttle sshd[3029]: pam_tcb(sshd:auth): Authentication failed for UNKNOWN USER from (uid=0)
Feb 6 23:10:15 shuttle sshd[3029]: Failed password for invalid user openerp from 181.10.44.51 port 37715 ssh2
Feb 6 23:10:16 shuttle sshd[3029]: Received disconnect from 181.10.44.51: 11: Bye Bye [preauth]
Feb 6 23:10:17 shuttle sshd[3027]: Invalid user helena from 186.20.214.92
Feb 6 23:10:17 shuttle sshd[3027]: input_userauth_request: invalid user helena [preauth]
Feb 6 23:10:17 shuttle sshd[3027]: pam_tcb(sshd:auth): Authentication failed for UNKNOWN USER from (uid=0)
Feb 6 23:10:18 shuttle sshd[3052]: refused connect from 201.21.202.252 (201.21.202.252)
Feb 6 23:10:18 shuttle sshd[3053]: refused connect from 189.6.45.130 (189.6.45.130)
Feb 6 23:10:18 shuttle sshd[3054]: refused connect from 196.22.190.249 (196.22.190.249)
Feb 6 23:10:19 shuttle sshd[3027]: Failed password for invalid user helena from 186.20.214.92 port 44832 ssh2
Feb 6 23:10:19 shuttle sshd[3027]: Received disconnect from 186.20.214.92: 11: Bye Bye [preauth]
Feb 6 23:10:20 shuttle sshd[3031]: Invalid user sagemath from 114.55.129.190
Feb 6 23:10:20 shuttle sshd[3031]: input_userauth_request: invalid user sagemath [preauth]
Feb 6 23:10:20 shuttle sshd[3031]: pam_tcb(sshd:auth): Authentication failed for UNKNOWN USER from (uid=0)
Feb 6 23:10:22 shuttle sshd[3031]: Failed password for invalid user sagemath from 114.55.129.190 port 41390 ssh2
Feb 6 23:10:22 shuttle sshd[3031]: Received disconnect from 114.55.129.190: 11: Bye Bye [preauth]
Feb 6 23:10:22 shuttle sshd[3062]: refused connect from 79.137.80.155 (79.137.80.155)
Feb 6 23:10:25 shuttle sshd[3064]: Connection closed by 192.168.1.100 [preauth]
Feb 6 23:10:28 shuttle sshd[3058]: Invalid user git from 139.59.106.82
Feb 6 23:10:28 shuttle sshd[3058]: input_userauth_request: invalid user git [preauth]
Feb 6 23:10:28 shuttle sshd[3058]: pam_tcb(sshd:auth): Authentication failed for UNKNOWN USER from (uid=0)
Feb 6 23:10:30 shuttle sshd[3058]: Failed password for invalid user git from 139.59.106.82 port 48536 ssh2
Feb 6 23:10:30 shuttle sshd[3058]: Received disconnect from 139.59.106.82: 11: Bye Bye [preauth]
Feb 6 23:10:39 shuttle sshd[3068]: Invalid user admin from 220.248.28.134
Feb 6 23:10:39 shuttle sshd[3068]: input_userauth_request: invalid user admin [preauth]
Feb 6 23:10:39 shuttle sshd[3068]: pam_tcb(sshd:auth): Authentication failed for UNKNOWN USER from (uid=0)
Feb 6 23:10:40 shuttle sshd[3070]: Invalid user git from 134.175.130.213
Feb 6 23:10:40 shuttle sshd[3070]: input_userauth_request: invalid user git [preauth]
Feb 6 23:10:40 shuttle sshd[3070]: pam_tcb(sshd:auth): Authentication failed for UNKNOWN USER from (uid=0)
Feb 6 23:10:40 shuttle sshd[3068]: Failed password for invalid user admin from 220.248.28.134 port 9732 ssh2
Feb 6 23:10:40 shuttle sshd[3068]: Received disconnect from 220.248.28.134: 11: Bye Bye [preauth]
Feb 6 23:10:42 shuttle sshd[3070]: Failed password for invalid user git from 134.175.130.213 port 48156 ssh2
Feb 6 23:10:42 shuttle sshd[3070]: Received disconnect from 134.175.130.213: 11: Bye Bye [preauth]preformatted text here
What's going on here? Is it somebody routing through a whole boatload of proxies? Are they spoofing IP's? And how can I stop/get away from this? My IDS/IPS is keeping them out so far, but what are the odds? I've considered moving sshd to another non-standard port, but a fresh nmap scan just point that out.
Advice?
Thanks.
