SSH Attacks question

neonrider · 09-14-2007, 12:02 PM

In my new host I have a Cpanel, which is completely different than Plesk that I had. Every day my server gets hundreds of failed login attempts. My host says it is normal and I should not pay attention. But the last sentence in this WHM warning says to investigate the even for the integrity of my host? Please help with advise. Is this normal so many login attempts? My server does not definitely host some Yahoo like websites. Thanks very much:

"The remote system 62.24.139.125 was found to have exceeded acceptable login failures on host.domain.com; there was 53 events to the service sshd. As such the attacking host has been banned from further accessing this system. For the integrity of your host you should investigate this event as soon as possible."

rllunzmann · 09-14-2007, 01:41 PM

i would just disable SSH if you feel that is strictly the issue.

BingoBalls · 09-14-2007, 02:55 PM

It is very normal. Servers in a hosting company are a sitting duck for hackers as many people dont perform normal security tasks. Whatever you do make sure that your passwords are really strong.

Is it a dedicated server you are using? If it is then you'll want to learn iptables and the best security policies to use.

I put an unprotected box (to test) on our network and the amount of brute force attacks on a daily basis is unbelievable.

**ToddW** · 09-14-2007, 11:51 PM

It's def. normal.

Bind SSH to only 1 IP, SSH Protocol 2, and you could even move it to another port if your host allows.

-Todd

iHubNet-Matt · 09-18-2007, 01:05 PM

It is just normal.
What firewall are you using in the server? You can try BFD if you are using APF which will block all IP's which makes failed logins above a threshold level.

Also, you can harden SSH, by making it listen on a different port and disabling the direct root login.

alemcherry · 09-20-2007, 02:07 AM

I get much more failed attempts daily! Running SSH on a non standard port is not a bad idea.

iHubNet-Matt · 09-20-2007, 09:00 AM

Quote:

Originally Posted by alemcherry

I get much more failed attempts daily! Running SSH on a non standard port is not a bad idea.

And changing the direct root login. Make a user with a unique name for ssh.